gootloader | 9b07a2200dc4ad3e3f50393a021dbca70e7bb18565ef99a41d877b2c3ac9a21d

Analysis

max time kernel
66s
max time network
70s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
23/09/2022, 17:09

Target

gaap_accounting_for_simple_agreement_for_future_equity (dov).js
Size

255KB
MD5

7d2b4deed92f944ed5c6c932e63785c9
SHA1

9129c2f8fc2c89c552a10992c0a1b19b830408f2
SHA256

9b07a2200dc4ad3e3f50393a021dbca70e7bb18565ef99a41d877b2c3ac9a21d
SHA512

493d3283e4de28988b51d2ce2b63b67af3c96eaad2ea4d9355efd0c03dc5139292a1582a26a51f1ff0b9cc8a33e287b7531bc39f8af585d6098886042acb5737
SSDEEP

6144:ygLfh6nWcr8uV1Tdp2YmDSrFEFyFgvL/2VX82yLwIPflhADG1+RH:y3AYmDImFy7s93PfHADG8RH

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	2676	wscript.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\gaap_accounting_for_simple_agreement_for_future_equity (dov).js"
1⤵
- Blocklisted process makes network request
PID:2676