win.gootkit (Back to overview)

GootKit

aka: talalpek, Xswkit
URLhaus      

Gootkit is a banking trojan, where large parts are written in javascript (node.JS). It jumps to C/C++-library functions for various tasks.

References
https://www.lexsi.com/securityhub/homer-simpson-brian-krebs-rencontrent-zeus-gootkit/
http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3669
https://securityintelligence.com/gootkit-developers-dress-it-up-with-web-traffic-proxy/
https://www.f5.com/labs/articles/threat-intelligence/tackling-gootkit-s-traps
https://securelist.com/blog/research/76433/inside-the-gootkit-cc-server/
https://www.us-cert.gov/ncas/alerts/TA16-336A
https://securityintelligence.com/gootkit-bobbing-and-weaving-to-avoid-prying-eyes/
https://www.youtube.com/watch?v=242Tn0IL2jE
http://blog.cert.societegenerale.com/2015/04/analyzing-gootkits-persistence-mechanism.html
https://www.s21sec.com/en/blog/2016/05/reverse-engineering-gootkit/
http://blog.trendmicro.com/trendlabs-security-intelligence/fake-judicial-spam-leads-to-backdoor-with-fake-certificate-authority/
http://www.vkremez.com/2018/04/lets-learn-in-depth-dive-into-gootkit.html
https://news.drweb.com/show/?i=4338&lng=en
https://www.cyphort.com/angler-ek-leads-to-fileless-gootkit/
https://www.youtube.com/watch?v=QgUlPvEE4aw
https://forums.juniper.net/t5/Security-Now/New-Gootkit-Banking-Trojan-variant-pushes-the-limits-on-evasive/ba-p/319055
Yara Rules
[TLP:WHITE] win_gootkit_auto (20190620 | autogenerated rule brought to you by yara-signator)
rule win_gootkit_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2019-07-05"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.2a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gootkit"
        malpedia_version = "20190620"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { f7f1 81c260ea0000 52 ff15???????? }
            // n = 4, score = 1800
            //   f7f1                 | div                 ecx
            //   81c260ea0000         | add                 edx, 0xea60
            //   52                   | push                edx
            //   ff15????????         |                     

        $sequence_1 = { f7f1 81c260ea0000 52 ff15???????? }
            // n = 4, score = 1800
            //   f7f1                 | div                 ecx
            //   81c260ea0000         | add                 edx, 0xea60
            //   52                   | push                edx
            //   ff15????????         |                     

        $sequence_2 = { f7f1 81c260ea0000 52 ff15???????? }
            // n = 4, score = 1800
            //   f7f1                 | div                 ecx
            //   81c260ea0000         | add                 edx, 0xea60
            //   52                   | push                edx
            //   ff15????????         |                     

        $sequence_3 = { f7f1 81c260ea0000 52 ff15???????? eb?? }
            // n = 5, score = 1700
            //   f7f1                 | div                 ecx
            //   81c260ea0000         | add                 edx, 0xea60
            //   52                   | push                edx
            //   ff15????????         |                     
            //   eb??                 |                     

        $sequence_4 = { 81c260ea0000 52 ff15???????? eb?? }
            // n = 4, score = 1700
            //   81c260ea0000         | add                 edx, 0xea60
            //   52                   | push                edx
            //   ff15????????         |                     
            //   eb??                 |                     

        $sequence_5 = { 81c260ea0000 52 ff15???????? eb?? }
            // n = 4, score = 1700
            //   81c260ea0000         | add                 edx, 0xea60
            //   52                   | push                edx
            //   ff15????????         |                     
            //   eb??                 |                     

        $sequence_6 = { f7f1 81c260ea0000 52 ff15???????? eb?? }
            // n = 5, score = 1700
            //   f7f1                 | div                 ecx
            //   81c260ea0000         | add                 edx, 0xea60
            //   52                   | push                edx
            //   ff15????????         |                     
            //   eb??                 |                     

        $sequence_7 = { ffd3 50 ff15???????? 8945ec 85c0 }
            // n = 5, score = 1500
            //   ffd3                 | call                ebx
            //   50                   | push                eax
            //   ff15????????         |                     
            //   8945ec               | mov                 dword ptr [ebp - 0x14], eax
            //   85c0                 | test                eax, eax

        $sequence_8 = { 8bc1 0f57c0 56 57 }
            // n = 4, score = 1500
            //   8bc1                 | mov                 eax, ecx
            //   0f57c0               | xorps               xmm0, xmm0
            //   56                   | push                esi
            //   57                   | push                edi

        $sequence_9 = { 85f6 74?? 46 2bde 03d8 }
            // n = 5, score = 1500
            //   85f6                 | test                esi, esi
            //   74??                 |                     
            //   46                   | inc                 esi
            //   2bde                 | sub                 ebx, esi
            //   03d8                 | add                 ebx, eax

        $sequence_10 = { 33c9 c745f804000000 41 33f6 85c0 8d45f8 50 }
            // n = 7, score = 1500
            //   33c9                 | xor                 ecx, ecx
            //   c745f804000000       | mov                 dword ptr [ebp - 8], 4
            //   41                   | inc                 ecx
            //   33f6                 | xor                 esi, esi
            //   85c0                 | test                eax, eax
            //   8d45f8               | lea                 eax, [ebp - 8]
            //   50                   | push                eax

        $sequence_11 = { 51 8bd7 8bce e8???????? 59 85c0 0f8????????? }
            // n = 7, score = 1500
            //   51                   | push                ecx
            //   8bd7                 | mov                 edx, edi
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   85c0                 | test                eax, eax
            //   0f8?????????         |                     

        $sequence_12 = { 52 50 8b4510 99 52 50 8b450c }
            // n = 7, score = 1200
            //   52                   | push                edx
            //   50                   | push                eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   99                   | cdq                 
            //   52                   | push                edx
            //   50                   | push                eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]

        $sequence_13 = { 75?? 8b7df4 32c0 8b4de4 }
            // n = 4, score = 1200
            //   75??                 |                     
            //   8b7df4               | mov                 edi, dword ptr [ebp - 0xc]
            //   32c0                 | xor                 al, al
            //   8b4de4               | mov                 ecx, dword ptr [ebp - 0x1c]

        $sequence_14 = { 52 50 8b4510 99 52 50 8b450c }
            // n = 7, score = 1200
            //   52                   | push                edx
            //   50                   | push                eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   99                   | cdq                 
            //   52                   | push                edx
            //   50                   | push                eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]

        $sequence_15 = { 50 8b4508 8b00 99 52 }
            // n = 5, score = 1000
            //   50                   | push                eax
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   99                   | cdq                 
            //   52                   | push                edx

        $sequence_16 = { 8b4508 8b00 99 52 }
            // n = 4, score = 1000
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   99                   | cdq                 
            //   52                   | push                edx

        $sequence_17 = { 8b4508 8b00 99 52 50 }
            // n = 5, score = 1000
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   99                   | cdq                 
            //   52                   | push                edx
            //   50                   | push                eax

        $sequence_18 = { 50 ff15???????? 50 ff15???????? 33c0 40 5d }
            // n = 7, score = 700
            //   50                   | push                eax
            //   ff15????????         |                     
            //   50                   | push                eax
            //   ff15????????         |                     
            //   33c0                 | xor                 eax, eax
            //   40                   | inc                 eax
            //   5d                   | pop                 ebp

        $sequence_19 = { 50 50 ff15???????? 50 ff15???????? 33c0 }
            // n = 6, score = 700
            //   50                   | push                eax
            //   50                   | push                eax
            //   ff15????????         |                     
            //   50                   | push                eax
            //   ff15????????         |                     
            //   33c0                 | xor                 eax, eax

        $sequence_20 = { 50 50 ff15???????? 50 ff15???????? 33c0 40 }
            // n = 7, score = 700
            //   50                   | push                eax
            //   50                   | push                eax
            //   ff15????????         |                     
            //   50                   | push                eax
            //   ff15????????         |                     
            //   33c0                 | xor                 eax, eax
            //   40                   | inc                 eax

        $sequence_21 = { 8b7510 8bd9 8b4d0c 57 0fbe7e01 8d5602 }
            // n = 6, score = 600
            //   8b7510               | mov                 esi, dword ptr [ebp + 0x10]
            //   8bd9                 | mov                 ebx, ecx
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   57                   | push                edi
            //   0fbe7e01             | movsx               edi, byte ptr [esi + 1]
            //   8d5602               | lea                 edx, [esi + 2]

        $sequence_22 = { 8d4602 5e 5b 5d c20c00 }
            // n = 5, score = 600
            //   8d4602               | lea                 eax, [esi + 2]
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   5d                   | pop                 ebp
            //   c20c00               | ret                 0xc

        $sequence_23 = { 8bec 53 56 8b7510 8bd9 8b4d0c 57 }
            // n = 7, score = 600
            //   8bec                 | mov                 ebp, esp
            //   53                   | push                ebx
            //   56                   | push                esi
            //   8b7510               | mov                 esi, dword ptr [ebp + 0x10]
            //   8bd9                 | mov                 ebx, ecx
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   57                   | push                edi

        $sequence_24 = { 53 56 8b7510 8bd9 57 8b7d0c 56 }
            // n = 7, score = 600
            //   53                   | push                ebx
            //   56                   | push                esi
            //   8b7510               | mov                 esi, dword ptr [ebp + 0x10]
            //   8bd9                 | mov                 ebx, ecx
            //   57                   | push                edi
            //   8b7d0c               | mov                 edi, dword ptr [ebp + 0xc]
            //   56                   | push                esi

        $sequence_25 = { 56 8b7510 8bd9 57 8b7d0c 56 }
            // n = 6, score = 600
            //   56                   | push                esi
            //   8b7510               | mov                 esi, dword ptr [ebp + 0x10]
            //   8bd9                 | mov                 ebx, ecx
            //   57                   | push                edi
            //   8b7d0c               | mov                 edi, dword ptr [ebp + 0xc]
            //   56                   | push                esi

        $sequence_26 = { ff15???????? b9bb010000 663bc1 75?? }
            // n = 4, score = 400
            //   ff15????????         |                     
            //   b9bb010000           | mov                 ecx, 0x1bb
            //   663bc1               | cmp                 ax, cx
            //   75??                 |                     

        $sequence_27 = { 85c0 75?? 8d4864 ff15???????? ffc3 83fb0a 7c?? }
            // n = 7, score = 300
            //   85c0                 | test                eax, eax
            //   75??                 |                     
            //   8d4864               | lea                 ecx, [eax + 0x64]
            //   ff15????????         |                     
            //   ffc3                 | inc                 ebx
            //   83fb0a               | cmp                 ebx, 0xa
            //   7c??                 |                     

        $sequence_28 = { 0f114f20 0f104840 0f114730 0f104050 }
            // n = 4, score = 300
            //   0f114f20             | movups              xmmword ptr [edi + 0x20], xmm1
            //   0f104840             | movups              xmm1, xmmword ptr [eax + 0x40]
            //   0f114730             | movups              xmmword ptr [edi + 0x30], xmm0
            //   0f104050             | movups              xmm0, xmmword ptr [eax + 0x50]

        $sequence_29 = { 0f114740 0f104850 0f114f50 0f104060 0f114760 8b4070 894770 }
            // n = 7, score = 300
            //   0f114740             | movups              xmmword ptr [edi + 0x40], xmm0
            //   0f104850             | movups              xmm1, xmmword ptr [eax + 0x50]
            //   0f114f50             | movups              xmmword ptr [edi + 0x50], xmm1
            //   0f104060             | movups              xmm0, xmmword ptr [eax + 0x60]
            //   0f114760             | movups              xmmword ptr [edi + 0x60], xmm0
            //   8b4070               | mov                 eax, dword ptr [eax + 0x70]
            //   894770               | mov                 dword ptr [edi + 0x70], eax

        $sequence_30 = { 0f110f 0f104820 0f114710 0f104030 0f114f20 0f104840 0f114730 }
            // n = 7, score = 300
            //   0f110f               | movups              xmmword ptr [edi], xmm1
            //   0f104820             | movups              xmm1, xmmword ptr [eax + 0x20]
            //   0f114710             | movups              xmmword ptr [edi + 0x10], xmm0
            //   0f104030             | movups              xmm0, xmmword ptr [eax + 0x30]
            //   0f114f20             | movups              xmmword ptr [edi + 0x20], xmm1
            //   0f104840             | movups              xmm1, xmmword ptr [eax + 0x40]
            //   0f114730             | movups              xmmword ptr [edi + 0x30], xmm0

        $sequence_31 = { 0f110f 0f104820 0f114710 0f104030 }
            // n = 4, score = 300
            //   0f110f               | movups              xmmword ptr [edi], xmm1
            //   0f104820             | movups              xmm1, xmmword ptr [eax + 0x20]
            //   0f114710             | movups              xmmword ptr [edi + 0x10], xmm0
            //   0f104030             | movups              xmm0, xmmword ptr [eax + 0x30]

        $sequence_32 = { 0f104060 0f114760 8b4070 894770 be01000000 ff15???????? }
            // n = 6, score = 300
            //   0f104060             | movups              xmm0, xmmword ptr [eax + 0x60]
            //   0f114760             | movups              xmmword ptr [edi + 0x60], xmm0
            //   8b4070               | mov                 eax, dword ptr [eax + 0x70]
            //   894770               | mov                 dword ptr [edi + 0x70], eax
            //   be01000000           | mov                 esi, 1
            //   ff15????????         |                     

        $sequence_33 = { 0f110f 0f104820 0f114710 0f104030 0f114f20 }
            // n = 5, score = 300
            //   0f110f               | movups              xmmword ptr [edi], xmm1
            //   0f104820             | movups              xmm1, xmmword ptr [eax + 0x20]
            //   0f114710             | movups              xmmword ptr [edi + 0x10], xmm0
            //   0f104030             | movups              xmm0, xmmword ptr [eax + 0x30]
            //   0f114f20             | movups              xmmword ptr [edi + 0x20], xmm1

        $sequence_34 = { 8d4dd0 e8???????? 5f 5e 8be5 }
            // n = 5, score = 200
            //   8d4dd0               | lea                 ecx, [ebp - 0x30]
            //   e8????????           |                     
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   8be5                 | mov                 esp, ebp

        $sequence_35 = { fec3 74?? 837d1800 75?? 6a20 e8???????? }
            // n = 6, score = 100
            //   fec3                 | inc                 bl
            //   74??                 |                     
            //   837d1800             | cmp                 dword ptr [ebp + 0x18], 0
            //   75??                 |                     
            //   6a20                 | push                0x20
            //   e8????????           |                     

        $sequence_36 = { 50 e8???????? 83c40c 89742444 8d442444 50 ff15???????? }
            // n = 7, score = 100
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   89742444             | mov                 dword ptr [esp + 0x44], esi
            //   8d442444             | lea                 eax, [esp + 0x44]
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_37 = { c20400 55 e8???????? cc }
            // n = 4, score = 100
            //   c20400               | ret                 4
            //   55                   | push                ebp
            //   e8????????           |                     
            //   cc                   | int3                

        $sequence_38 = { 8d442434 8bcb 50 e8???????? 8d442448 }
            // n = 5, score = 100
            //   8d442434             | lea                 eax, [esp + 0x34]
            //   8bcb                 | mov                 ecx, ebx
            //   50                   | push                eax
            //   e8????????           |                     
            //   8d442448             | lea                 eax, [esp + 0x48]

        $sequence_39 = { 50 8d0c1f 51 53 }
            // n = 4, score = 100
            //   50                   | push                eax
            //   8d0c1f               | lea                 ecx, [edi + ebx]
            //   51                   | push                ecx
            //   53                   | push                ebx

        $sequence_40 = { 55 57 68d4d70210 56 8944244c e8???????? 55 }
            // n = 7, score = 100
            //   55                   | push                ebp
            //   57                   | push                edi
            //   68d4d70210           | push                0x1002d7d4
            //   56                   | push                esi
            //   8944244c             | mov                 dword ptr [esp + 0x4c], eax
            //   e8????????           |                     
            //   55                   | push                ebp

        $sequence_41 = { 8b402c 135c2414 2bf2 1b7c2414 2910 8b442410 8b401c }
            // n = 7, score = 100
            //   8b402c               | mov                 eax, dword ptr [eax + 0x2c]
            //   135c2414             | adc                 ebx, dword ptr [esp + 0x14]
            //   2bf2                 | sub                 esi, edx
            //   1b7c2414             | sbb                 edi, dword ptr [esp + 0x14]
            //   2910                 | sub                 dword ptr [eax], edx
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]
            //   8b401c               | mov                 eax, dword ptr [eax + 0x1c]

    condition:
        7 of them
}
Download all Yara Rules