gootloader | 1a7e1bd7462f72a77512759558d49fc45a777dfa043afed135dadb0786cecc42

Analysis

max time kernel
153s
max time network
162s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
20/09/2022, 16:44

Target
a79e2f777a0fbeada056d560077fe0283af6c5acc0e9e44fce0fad702b962989.js
Size 483KB
Sample220920-t86wpahdek
SHA256 a79e2f777a0fbeada056d560077fe0283af6c5acc0e9e44fce0fad702b962989
MD5 886d1e2aa84734964dc9141f58dc7ddf
SHA1 93a1923dc244d4c565588598c0bcc9f285a9a958
SHA512 bdcbb1fcf6051fa14c2c0a63abb063000335709fc9957ccb72ca5ce313fa5cb3751eeb4fc9187f7a085d41fee771294f0879f8525911555946bcdf05b576389c
SSDEEP 6144:uQ4XjTula/l44hEfD3MA7Wiagmd4iLAmWR6USF:qLhEfD3Mviagmd4iLAmWR6R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\a79e2f777a0fbeada056d560077fe0283af6c5acc0e9e44fce0fad702b962989.js
1⤵
- Blocklisted process makes network request
PID:4880