gootloader | efa71e4c6b52be12d66ba4433a51db55f19ba3aa95ea419c996b3479944193e5

Analysis

max time kernel
285s
max time network
289s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02/09/2022, 10:02

Target
Tree_removal_agreement_between_neighbor's (fz).js
Size 483KB
Sample220902-l2tnsaeda7
SHA256 947a0938d118bfa0b8639598bd1b5aa197f5e163b7dc53988e2f420297f1ed2a
MD5 70431b33daf24ceaa1d13884889e6687
SHA1 80b5aa7b3a68836b2b7b3046c0295b4ddb5866ca
SHA512 3ed05bef14418fd25b064665c4f4c2d35f976c8365e352c130a2661afab22e0050f8574b189a711e959f981e8c8f508c5249f06157efd5a5c2f99eb433bcb9cd
SSDEEP 6144:uUQNXSZulaxl4khEfD3vb7biagmdpiLAmWR6GSF:bvhEfD3vriagmdpiLAmWR6j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Tree_removal_agreement_between_neighbor's (fz).js"
1⤵
- Blocklisted process makes network request
PID:2928