gootloader | 1a7e1bd7462f72a77512759558d49fc45a777dfa043afed135dadb0786cecc42

Analysis

max time kernel
205s
max time network
208s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
20-09-2022 16:44

Target

6f5fe53a35e556255d6df96734cffba175d79c21a8bbfd08bb9d97225f503566.js
Size

483KB
MD5

4f774c3bf5bc71f86d8d12524928418b
SHA1

58220367e9ff9199c69031064db48bbd56225273
SHA256

6f5fe53a35e556255d6df96734cffba175d79c21a8bbfd08bb9d97225f503566
SHA512

d66bb49a58b7f0dbf24d090de92b605833f99eae034c38ee5fa1e01cc8562736834cd602d4b2dbdc01e7a69c14d1379fd199d397775fd7ecaaf20bfa981fe556
SSDEEP

6144:1XQTYjdhculaxl41hEfDdxA7WiagmduiLAmWR6USg:VX5hEfDdxviagmduiLAmWR6s

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\6f5fe53a35e556255d6df96734cffba175d79c21a8bbfd08bb9d97225f503566.js
1⤵
- Blocklisted process makes network request
PID:2016