gootloader | 17696097b3244366652cb10df5e3a8e84b030dc636f23784ec77894e09d5a091

Analysis

max time kernel
196s
max time network
200s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
26/08/2022, 11:14

Target
How_to_threaten_legal_action_sample_letter (cpa).js
Size 483KB
Sample220826-ncejnscfc4
SHA256 1a6f55464f365e187f79a50a24ff3f6da4c47faaba2c87cf6fdd2a2068ac4084
MD5 599ad5b29416b2ae7a79f5946fcd60e7
SHA1 9b79bf7de73e60f609ce431153e071ca45d05bcc
SHA512 68d6f1960651935cbacd218943c5779b45e5bb648204d9f7b3262a11d2fdd38861b64d94e80fa8f5364c193fe881c9dfbec086fbdc3b8fccda87f5211956a1c5
SSDEEP 6144:hQdKwtulaxl4khEfD3hA7Niagmd4iLAmWr6FQF:ujhEfD3haiagmd4iLAmWr6o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\How_to_threaten_legal_action_sample_letter (cpa).js"
1⤵
- Blocklisted process makes network request
PID:1556