Overview

overview

10

Static

static

1

union_of_t...11).js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    union_of_taxation_employees_collective_agreement(3911).js

  • Size

    10.6MB

  • Sample

    240919-nkawfswbmd

  • MD5

    21d81b3dbba892299cafc36f383fcdf6

  • SHA1

    c1f7302534ddc799e2d8f3adf8bad88197f4d630

  • SHA256

    f0035572eeaa0b2c6163c2d10a25e3a0c288dd0a0ff421aace09dcecfb91104f

  • SHA512

    e060c3e4f78b6712ec5c3c0cb9c572877661b875085fe1e9b20dbb85cf41c4a6f021dab295f85f537f0b4dd2176b1256d68e6ddbaf467c0542aa0954756be818

  • SSDEEP

    49152:V1Yyna8vwbV5brH/s+LfHQe1Yyna8vwbV5brH/s+LfHQe1Yyna8vwbV5brH/s+Ly:VUUUUUUUo

Score
10/10
gootloaderexecutionloader

Malware Config

Targets

    • Target

      union_of_taxation_employees_collective_agreement(3911).js

    • Size

      10.6MB

    • MD5

      21d81b3dbba892299cafc36f383fcdf6

    • SHA1

      c1f7302534ddc799e2d8f3adf8bad88197f4d630

    • SHA256

      f0035572eeaa0b2c6163c2d10a25e3a0c288dd0a0ff421aace09dcecfb91104f

    • SHA512

      e060c3e4f78b6712ec5c3c0cb9c572877661b875085fe1e9b20dbb85cf41c4a6f021dab295f85f537f0b4dd2176b1256d68e6ddbaf467c0542aa0954756be818

    • SSDEEP

      49152:V1Yyna8vwbV5brH/s+LfHQe1Yyna8vwbV5brH/s+LfHQe1Yyna8vwbV5brH/s+Ly:VUUUUUUUo

    Score
    10/10
    gootloaderexecutionloader

    • GootLoader

      JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

      loadergootloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks