Rewterz Threat Alert – Gootkit Trojan Active- IOCs

Severity

High

Analysis Summary

Gootkit is complex multi-stage banking malware has been arround since 2014. Initially it was distributed via spam and exploits kits such as Spelevo and RIG. In conjunction with spam campaigns, the adversaries later switched to compromised websites where the visitors are tricked into downloading the malware. Gootkit is capable of stealing data from the browser, performing man-in-the-browser attacks, keylogging, taking screenshots and lots of other malicious actions. Its loader performs various virtual machine and sandbox checks and uses sophisticated persistence algorithms. In 2019, Gootkit stopped operating after it experienced a data leak, but has been active again since November 2020. Gootkit’s victims are mainly located in EU countries such as Germany and Italy.

Impact

• Unauthorized Access

Indicators of Compromise

Domain Name

• kvaladrigrosdrom[.]top
• scellapreambulus[.]top
• lbegardingstorque[.]com
• kerymarynicegross[.]top
• pillygreamstronh[.]com

MD5

• 97713132e4ea03422d3915bab1c42074

SHA-256

• 3966cb4e8d6f111dd98fb07158547d0080a9b9cba698c73b42c2499cdbb70416

SHA1

• a90c6e7c5650e73ceb0b329fa8c78045632100ee

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.
• Do not download files from untrusted sources or emails.