gootloader | efa71e4c6b52be12d66ba4433a51db55f19ba3aa95ea419c996b3479944193e5

Analysis

max time kernel
250s
max time network
253s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
02/09/2022, 10:02

Target
Is_a_hand_written_custody_agreement_legal (omp).js
Size 483KB
Sample220902-l2tnsaeda7
SHA256 de7a72d1bbdb88ae0679a48dfc259c728f5a64cd92dc60eac494e94298663246
MD5 5ed401a80f318847b0da8627a4460e76
SHA1 bb8ed711de598261b700c7f705adaf17024eb3d2
SHA512 5d1c35bed3948722db593e70b09801e16c623a2b07bfa0a21f3b3baa66e0d97d3a7390e3456cce69e38111ca3bac12bf428a61799d85c2f9e735b2a193e1de55
SSDEEP 6144:eJirbQNZXSnulaxl4FhEfD3C9A7Biagmd4iLAmWo6kSF:eJir4oWhEfD3C9wiagmd4iLAmWo6B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Is_a_hand_written_custody_agreement_legal (omp).js"
1⤵
- Blocklisted process makes network request
PID:5092