gootloader | 8c99377f98e1805098241aecc5c63bd4c7f9540eb3305732e3dbbd94207083b9

Analysis

max time kernel
144s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2022, 23:12

Target
a_contract_of_employment_is_deemed_as_a_legal_and_binding_document (lvs).js
Size 255KB
Sample220928-26xt1aadem
SHA256 dca14bb1a1bc4649d8367ebb7ac3695562e52ae7d9bcf18dca2fa1c5ed7f4492
MD5 6e86b3ed71a0bf97465ccec58f43398f
SHA1 85eda541a76c9b2b0d72b06d41544222797f818f
SHA512 633a2f2d8c7b83b6e3e18f2d38b8f4ad6e7b10ddc8972bd926500eba22e0aab837949af8c7f139eee163cd3325b566e6da5e7d037d4046f61f36ccf837827b48
SSDEEP 6144:yeLfh6Jmcr8uVaTdpsYmDwgFEFyY1vL/3VX82hLHIPf2+ADD1+RH:ynzYmD3mFyQs4MPfVADD8RH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
42	1976	wscript.exe
44	1976	wscript.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\a_contract_of_employment_is_deemed_as_a_legal_and_binding_document (lvs).js"
1⤵
- Blocklisted process makes network request
PID:1976