gootloader | c254d2ade6ce2ec380c69d7efcc2ebb64a533eb2c8cd8714b8c091a983477bc1

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 13:20

Target

Travelers_waiver_of_probate_and_agreement_of_indemnity_exhibit_c (mfypk).js
Size

483KB
MD5

c18330dd36d3f1bd8d10364fb12993cb
SHA1

c83855860ab80a0b9edc51c8834d0027a2a5711a
SHA256

9e3100fd0ce07054eb636321f1f148e29d3fce123f52707ec46a7030472cdca0
SHA512

8d25680eade0b4e7653267ac454d5f54f138091a3ec2abf617f1b9e9e78aeb08a217d6c3e431ff2d6256ecece69b54816ac73394cd9bd059896705961bf6108f
SSDEEP

6144:rQBtXGTulaxl4IhEfD3xA7ziagmd4iLAmWR6LSF:AgThEfD3xuiagmd4iLAmWR6I

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
38	1152	wscript.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	38	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Travelers_waiver_of_probate_and_agreement_of_indemnity_exhibit_c (mfypk).js"
1⤵
- Blocklisted process makes network request
PID:1152