51a5678e3dcba33c7201090bbaa09a6d04ebd14eaa8a5c7e56a18a4ab7611acc

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Gofot.crg.d10d3347530959aa15ac35ffebf2e4d7
Size 366KB
Sample261018-v5bf2sswew
SHA256 51a5678e3dcba33c7201090bbaa09a6d04ebd14eaa8a5c7e56a18a4ab7611acc
MD5 d10d3347530959aa15ac35ffebf2e4d7
SHA1 25810fea82d399a5cbcc5591fb116217488692ee
SHA512 c100e24c5abad2ef50c44ebbfd89a41a1bfb7f137cffeacde7526bf99b5141a18ce992142d62d942281cf45abfcba03bf464a9f7504b4ee83475ae9a2bc238d0
SSDEEP 6144:Je34uRAKkpJ8SnUfdJF7dRacRN5mGwRQwIJLHHNhjVnlo7OpjPwBiiKOI2FiqOpC:+OD8LJF7LIvRFuLHRnppjPk82s8Jd
TLSH
T13984228AD5E1ACBFFD83863262FDF15AE67F13901121682F439567AD3E9022D09449CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jaffacakes118_Trojan.Win32.Gofot.crg.d10d3347530959aa15ac35ffebf2e4d7
- Size 366KB
- SHA256 51a5678e3dcba33c7201090bbaa09a6d04ebd14eaa8a5c7e56a18a4ab7611acc
- MD5 d10d3347530959aa15ac35ffebf2e4d7
- SHA1 25810fea82d399a5cbcc5591fb116217488692ee
- SHA512 c100e24c5abad2ef50c44ebbfd89a41a1bfb7f137cffeacde7526bf99b5141a18ce992142d62d942281cf45abfcba03bf464a9f7504b4ee83475ae9a2bc238d0
- SSDEEP 6144:Je34uRAKkpJ8SnUfdJF7dRacRN5mGwRQwIJLHHNhjVnlo7OpjPwBiiKOI2FiqOpC:+OD8LJF7LIvRFuLHRnppjPk82s8Jd
- TLSH
  T13984228AD5E1ACBFFD83863262FDF15AE67F13901121682F439567AD3E9022D09449CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 44KB
- SHA256 1af3ac7d3176af42e8594ba0c33821d3318f4eea5cbb799bf8fab58e480efe0e
- MD5 3599d30554ad65dc29fc689217d2152e
- SHA1 8f5fcc313b667a1de2d56573bcf98d43fd0d4ff9
- SHA512 846776b1d908b5204667715ffdfd3a6c76dface1677e8b1e5156ceac2ef0a739f68b48ccbb919c9e08d6ff359a93174bf0b90def7d48cee54cd3c41d8d8575f2
- SSDEEP 768:oY6+2hD1lu3SFh80Z9pe7nJRJ3QN8DOUVowlo+J:76xhZlM0h/9panJ73CSFl
- TLSH
  T1F8137D117C8285F3C59A457962D91F575B3F66001BF580871FFA1A6EAF372E0AA3E302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  BomulBoxC.exe
- Size 725KB
- SHA256 22e20debb0b8d4de152ef122e11cbef1d94d8df74b99a96c3b6afa8ca14a2e85
- MD5 5bcd355f7594869c3df982f0b6092e89
- SHA1 3c19ee9e83eb26da2ccca276817667642e734b8d
- SHA512 5dc8dd48c7b98b1ea485b30c29140c86ee9a285319bfc873c9599e2327425cbb72111b656b08805d143d476fa4717b7e38e441f1f29a24429a439d054fccd3b5
- SSDEEP 6144:EVjPCGHUYoWwgkbRUCNgsF0NywJWvAf1WTvCZ3jvyJiTcPDqlzIEAJg80SoQD2dk:8jpZkNlNgy29WTvCxLy0TjZAe80So+j
- TLSH
  T1FDF46A0177F1C1F6C68286320DBB931963B2FE965B24AAC737D83B5F9E351D16A38211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  UninstallExpressService.exe
- Size 32KB
- SHA256 c25c6f5d71bc86cbc6c1ba8a4232b00f2563d24bef74d4f7320ffbe179ac926c
- MD5 8d96315a729fd0739faa862ef3021b43
- SHA1 3091144193a3e187fb9722d87bae5b8511169e10
- SHA512 b9061900803442ee727b780d12da7d3a4a1b17f4abb222b276b4829db8732a954cad4e5c5f0b908ba17f5bcc7149c310132fed6913181101f0ce6a344070bf50
- SSDEEP 768:oHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJRJRnod:opgpHzb9dZVX9fHMvG0D3XJGd
- TLSH
  T100E28F1B79C08DBBD9D3463106B7B77DEBBBC2C902525A034B782F7E3D614538A09296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
behavioral10 behavioral9