gootloader | b0fc681c060b77fdc4c72609b803874690be98511616fa0175d3bedfdc913ccb

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 14:33

Target
Wellcare_waiver_of_liability_form_texas (nq).js
Size 483KB
Sample230106-rxcglagh43
SHA256 b0fc681c060b77fdc4c72609b803874690be98511616fa0175d3bedfdc913ccb
MD5 dec0aa6a1dd7c71b05b8113573ced35f
SHA1 7d79446c30833187670e5262c330beb5b36159e8
SHA512 adbe75030781ba128747041e869be91ad830dddf158c944a80fa407cb9323318a91c68a6cee10398f6b5dae26128956603c8c06cc7fc477295a5058fd29b879e
SSDEEP 6144:EQbRSpulaxl4PhEfDKxA9Wiagmd4iLAmWR6JSF:KohEfDKxZiagmd4iLAmWR6W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Wellcare_waiver_of_liability_form_texas (nq).js"
1⤵
- Blocklisted process makes network request
PID:4160