gootloader | 666e249275d61963bf4220af39016a2d11ac30c6a27d0503179625636665bae6

Analysis

max time kernel
175s
max time network
178s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
29-09-2022 10:29

Target

0c7b24793eb977294b87af72948a38f7872744a6aeb142054d56a91646e4f16c.js
Size

483KB
MD5

c57912758c805533a87df7d4b3b8ec03
SHA1

393b6c1a91f976609be459705558f64858f8b9f4
SHA256

0c7b24793eb977294b87af72948a38f7872744a6aeb142054d56a91646e4f16c
SHA512

643e9c80663c291c4f53d310abfd276bef4ebbf960cc903ea061f757d88eab090b1381bad1363ed1da2f04ecd67fcf57f8736b972db3c51b755f7ef40b23ad7e
SSDEEP

6144:8QvDDzulaxl4khEfD6xN7WiagmdjiLAmWR65XF:lBhEfD6xoiagmdjiLAmWR6X

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

13 3788 wscript.exe
15 3788 wscript.exe
17 3788 wscript.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\0c7b24793eb977294b87af72948a38f7872744a6aeb142054d56a91646e4f16c.js
1⤵
- Blocklisted process makes network request
PID:3788