gootloader | 94188a650755ca5f48b6f8d0697a29ebed882793bd8ea5dc1943286a561eef7f

Resubmissions

20/10/2022, 17:25

14/10/2022, 19:05

12/10/2022, 13:34

max time kernel
121s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 13:34

Target
17-Where_to_find_property_tax_roll_number (enyy).js
Size 291KB
Sample221012-qvgsvsdfdp
SHA256 94188a650755ca5f48b6f8d0697a29ebed882793bd8ea5dc1943286a561eef7f
MD5 0279503d9ae615fb31f707d427ed9fb7
SHA1 b0a8fd1208580e0c960d576bf02469845058d9a1
SHA512 98e8800965a866b01f75aa86e51f2d287d74194283290114ee29c6b07bab738f67209c7eddb0cee092e4ac85f43d19675ce14b68b17277a4b878ccb885f06f09
SSDEEP 6144:ptLfh6nicf8Z5wPTdpR4mDtU1EsnFyRguh3NOxPnS8kVLjIVfzcAKWk1PC:pIl4mDCTFyckgVfoAKBZC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
33	4984	wscript.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	33	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\17-Where_to_find_property_tax_roll_number (enyy).js"
1⤵
- Blocklisted process makes network request
PID:4984