gootloader | 60fb7d5d08e4b91eb6978af3bcf3cc0143834fe0e98c7c3a7af7f7d52084e961

Analysis

max time kernel
207s
max time network
209s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
13/09/2022, 12:54

Target
Agreement_of_guiding_principles_(property_insurance) (envph).js
Size 483KB
Sample220913-p5aa4affc6
SHA256 e5b9b96238ad4b273421fb5fa05765538633979f825ef2a529e6feced1b9bd01
MD5 5f244e629f304cfa708a430457d7f28b
SHA1 ddd30b83da125316a01d2d1a58c9ca958ce1e536
SHA512 2098c953e843938af617913bdcac367066794841668f436e05c2c27cb358b1e75fd9189a87b3a4a6b71b74730a55b3103c10667bdd7591a1fdd4d7296f118ce6
SSDEEP 6144:EQmXQpulaxl44hEfDnxA7Viagmd4iLAmWR6xSF:pvhEfDnxmiagmd4iLAmWR6u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Agreement_of_guiding_principles_(property_insurance) (envph).js"
1⤵
- Blocklisted process makes network request
PID:3336