Overview

overview

10

Static

static

3

jaffacakes...wm.exe

windows10-2004-x64

10

jaffacakes...wm.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan.Win32.Inject.akrwm.259ab80dd757a3fe278170610632fb3c
  • Size 260KB
  • Sample261018-xeerwstvd1
  • SHA256 baffdd7dce6893c9ea571dec2a6288ce3203f4b995217109ec64dbba1feac921
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
gootkit308bankerbotnetdefense_evasiondiscoveryexecutionprivilege_escalationtrojan

Malware Config

Extracted

Family

  • gootkit

Botnet

  • 308

C2

  • waabitii.com

  • buyyou.org

  • pep.hheadz4life.com

  • trktrk.org

  • fields.mobi

Attributes
  • vendor_id

    308

Targets

    • Target
      jaffacakes118_Trojan.Win32.Inject.akrwm.259ab80dd757a3fe278170610632fb3c
    • Size 260KB
    • SHA256 baffdd7dce6893c9ea571dec2a6288ce3203f4b995217109ec64dbba1feac921
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankerbotnet308defense_evasiondiscoveryexecutiongootkitprivilege_escalationtrojan

    • Family: Gootkit

      Gootkit is a banking trojan, where large parts are written in node.JS.

      trojanbankerbotnetgootkit

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks