gootloader

General

Target

Agreement_between_husband_and_wife_sample_98157.zip.7z
Size

1.9MB
Sample

240731-xyl1batdpa
MD5

34206a2b453f6fbd43f385a30fa33408
SHA1

25e594dcea9109c4d79ad35bbf138642427ab1d1
SHA256

7c968be280ae9e6c8f0ee971eb7ee65f988babda748d266faf9c24966fcfb6fb
SHA512

a9786990b8c6898af1dc008dc182cbf5ac220f4f116a920302b8c8d308186f1a815ce3ce35ec0758b98ea785e8c6deddfb947e7d9a089e7cabc2ca85bab35d75
SSDEEP

49152:tiwcS5VBWKAQJwU72FQ9BMXM/if+QbuDXKxvVSV+0K:7fWj6e8BMc/ifHBFka

Score

10^/10

Malware Config

Targets

- Target
  
  Agreement_between_husband_and_wife_sample_98157.zip.7z
- Size
  
  1.9MB
- MD5
  
  34206a2b453f6fbd43f385a30fa33408
- SHA1
  
  25e594dcea9109c4d79ad35bbf138642427ab1d1
- SHA256
  
  7c968be280ae9e6c8f0ee971eb7ee65f988babda748d266faf9c24966fcfb6fb
- SHA512
  
  a9786990b8c6898af1dc008dc182cbf5ac220f4f116a920302b8c8d308186f1a815ce3ce35ec0758b98ea785e8c6deddfb947e7d9a089e7cabc2ca85bab35d75
- SSDEEP
  
  49152:tiwcS5VBWKAQJwU72FQ9BMXM/if+QbuDXKxvVSV+0K:7fWj6e8BMc/ifHBFka
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  Agreement_between_husband_and_wife_sample_98157.zip
- Size
  
  1.9MB
- MD5
  
  2a92faab2922c3c7c387be73fe184127
- SHA1
  
  f895c714c95df13a9a6818afd646d391a315aa76
- SHA256
  
  e6f2617003a95796a30b06743f827863ca1277aa677fb9ed1f57e8eb60229ee6
- SHA512
  
  34d65309e9b8495d7ce83988633348d2e595962ee353e21737aad08cdcf88b03e0949d92be08905acb151a6af5b3532894ee039187390d687a058af357f1a139
- SSDEEP
  
  49152:Nvvfkn+Q2XsHhhcXlC6ybvDF4EczsvhzvD32basS5E7:No+T8HhCVCLd/AcXcasSI
Score

1^/10
behavioral3 behavioral4
- Target
  
  agreement between husband and wife sample 5217.js
- Size
  
  20.5MB
- MD5
  
  ec0f178a649479022efd92b114f24f95
- SHA1
  
  7b18b2fc85fb949af3f4b372bd5b5e2fe1d8ddbf
- SHA256
  
  a4502a98e81027437e18f559775fcb89b2400f1c026409261290a00532c354a7
- SHA512
  
  35c16eaca7de7c4d6550e9b3612170671453ee502a55e78d60927846c6afb091546ec9f865e589970565d90cbd7f037f37332ceed32243bdabf70bfca8596806
- SSDEEP
  
  49152:YYRxr8uC0NjaCX3lgYRxr8uC0NjaCX3lgYRxr8uC0NjaCX3lf:x//J
Score

10^/10

gootloader execution loader
- GootLoader
  JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
  loader gootloader
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6