Overview

overview

10

Static

static

1

canada rev...615.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    canada revenue agency psac collective agreement 21615.js

  • Size

    20.5MB

  • Sample

    240726-mgy87s1fnq

  • MD5

    1add5539fec37fcc25c5223fa890a944

  • SHA1

    d9681e3eab7b0f6974f3cc0b13657376f9e6a72b

  • SHA256

    173cf21fb6eb97344bf1e5941efab13afcadaed98dfa8ade37d672e2233d63c2

  • SHA512

    4675f0442cf73061ca42be78b4f62904fb29825c74308c487543a9d7f6225a28585de4a154e91f9c85c991f6dfc3c6f6fdbcfb54cd38dd9db119b2551dc5d290

  • SSDEEP

    49152:YYRxr8uC0NjaCXWigYRxr8uC0NjaCXWigYRxr8uC0NjaCXWif:Y772

Score
10/10
gootloaderexecutionloader

Malware Config

Targets

    • Target

      canada revenue agency psac collective agreement 21615.js

    • Size

      20.5MB

    • MD5

      1add5539fec37fcc25c5223fa890a944

    • SHA1

      d9681e3eab7b0f6974f3cc0b13657376f9e6a72b

    • SHA256

      173cf21fb6eb97344bf1e5941efab13afcadaed98dfa8ade37d672e2233d63c2

    • SHA512

      4675f0442cf73061ca42be78b4f62904fb29825c74308c487543a9d7f6225a28585de4a154e91f9c85c991f6dfc3c6f6fdbcfb54cd38dd9db119b2551dc5d290

    • SSDEEP

      49152:YYRxr8uC0NjaCXWigYRxr8uC0NjaCXWigYRxr8uC0NjaCXWif:Y772

    Score
    10/10
    gootloaderexecutionloader

    • GootLoader

      JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

      loadergootloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks