gootloader | 60fb7d5d08e4b91eb6978af3bcf3cc0143834fe0e98c7c3a7af7f7d52084e961

Analysis

max time kernel
298s
max time network
300s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
13/09/2022, 12:54

Target
How_to_fill_t1-ovp_form (owvv).js
Size 483KB
Sample220913-p5aa4affc6
SHA256 02e477b52df4ea910526f3bad988aeaabcb2ac4d5e98b4cbc47a4c36b32acf4f
MD5 6962b25999460084e0556b0482067eff
SHA1 354bc001089e5a4e9c4352b95bbf26d25858d2e6
SHA512 3d2fd051ee5d68a4eec4486c71914dd05010c75f9fb810258a6f78e3dab59996baed690d85a76f220b432e5ad3e88a1fb6347e0fc3e414da19c859c91a737113
SSDEEP 6144:xQW+tTulaxl4khEfD3xA7cGiagmd7iLAmWH6WSF:ChhEfD3xVGiagmd7iLAmWH6T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	2196	wscript.exe
9	2196	wscript.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\How_to_fill_t1-ovp_form (owvv).js"
1⤵
- Blocklisted process makes network request
PID:2196