gootloader | bffa3647c286b949d1e65d526fedf0c95fef899e201cda84de213ba2a8f9b46e

Analysis

max time kernel
293s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2022, 18:15

Target
ab415370f0033fbddc4ff5fe7de318e6df15b902714b69fbc235db6da41a2348.js
Size 296KB
Sample220923-wwbwwshfa7
SHA256 ab415370f0033fbddc4ff5fe7de318e6df15b902714b69fbc235db6da41a2348
MD5 261fd5425a60b044c5f9a584473b2a10
SHA1 66bef53d081fd7e4336bd55adea6cd1eda1bb740
SHA512 883045f862cb1a54309f2f04db5fb58c789b61235925d85549463cadcee516cbf319ed30865feef180fd950bb18a56f8d1c779db0164d45eb798aaa173bd388c
SSDEEP 6144:iaaKxfbLY8Cv4okFFmwLFbP60y3JEBI/Hw0KUWrE4/Xp89NwzY1Z5nOeK2+pHeJy:wOLFbPD2kIY0KUWrE4/589bE7vHeyb7l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	85	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	102	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	83	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ab415370f0033fbddc4ff5fe7de318e6df15b902714b69fbc235db6da41a2348.js
1⤵
- Blocklisted process makes network request
PID:3928