Overview

overview

10

Static

static

1

contractin...887.js

windows7-x64

10

contractin...887.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Contracting_officer_warrant_test_sample_51386.zip

  • Size

    2.2MB

  • Sample

    240521-y5wnrshd2y

  • MD5

    b61d5cf4481554b6bc95dbd5d3d3140d

  • SHA1

    2e5305416ed96082133a6bc5634e203819fee7c3

  • SHA256

    0614fc6fa15dbf5663b0452ce2dd899636f87d95912da3c81905482ea7954ec1

  • SHA512

    de6ba570312f8de256674f2e2b37ba30501794c0a8e6fe430734f078a053578a909f228851887fe4ba8f8773c3d53fee4abf63586c9b1e863dc953ee5c8f7541

  • SSDEEP

    49152:UGbTTID3dSoWM3yFjrljuGZ0y9Kofb9ifzog6Gdx+vh/y:UjdSoWYy9ljdZRROoghkvM

Score
10/10
gootloaderexecutionloader

Malware Config

Targets

    • Target

      contracting officer warrant test sample 58887.js

    • Size

      8.8MB

    • MD5

      33da02d45d35dca896fca2d03c478f8b

    • SHA1

      9b3c01d445f8e3fb25b4c786a721e579e5f649fb

    • SHA256

      ccdb11c9b3ff0f96316f2f82c5073a199c67204aa6b155f18d7c8a0f2e092f1d

    • SHA512

      ce85b283b3a7493410943ef38de9969fef200c2e6a6bad1351e6996c420110fee034547008d5a3a1f9ff0b67a34843eae1e27c9c8fbf90439e9c633a47b16567

    • SSDEEP

      49152:VytwpCQK+XzytwpCQK+XzytwpCQK+XzytwpCQK+XzytwpCQK+XzytwpCQK+XzytG:n

    Score
    10/10
    gootloaderexecutionloader

    • GootLoader

      JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

      loadergootloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks