Overview

overview

10

Static

static

1

unionoftax...285.js

windows7-x64

10

unionoftax...285.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    unionoftaxationemployeescollectiveagreement35285.js

  • Size

    10.6MB

  • Sample

    240920-vz39waydpj

  • MD5

    a4941b073a1cf1183a4f3be6ac321ce4

  • SHA1

    41383a555a57144cdce8d3bea8d61123c15c6148

  • SHA256

    d69806d3e2d3a414278334188894d3c3f1704f047aa9cb72d6b85f48f7de45b0

  • SHA512

    4d42854364311f17db09edc2cd8bc535a03dbdd8972bd608963adb63dcb3a8ec258479d00fa2cfd84ef11c7b5779f94e955b403ed3317309463a394a282fa82a

  • SSDEEP

    49152:H3ncwnVlbwzu6Uvq/s+LfHQe3ncwnVlbwzu6Uvq/s+LfHQe3ncwnVlbwzu6Uvq/Q:H4444444s

Score
10/10
gootloaderexecutionloader

Malware Config

Targets

    • Target

      unionoftaxationemployeescollectiveagreement35285.js

    • Size

      10.6MB

    • MD5

      a4941b073a1cf1183a4f3be6ac321ce4

    • SHA1

      41383a555a57144cdce8d3bea8d61123c15c6148

    • SHA256

      d69806d3e2d3a414278334188894d3c3f1704f047aa9cb72d6b85f48f7de45b0

    • SHA512

      4d42854364311f17db09edc2cd8bc535a03dbdd8972bd608963adb63dcb3a8ec258479d00fa2cfd84ef11c7b5779f94e955b403ed3317309463a394a282fa82a

    • SSDEEP

      49152:H3ncwnVlbwzu6Uvq/s+LfHQe3ncwnVlbwzu6Uvq/s+LfHQe3ncwnVlbwzu6Uvq/Q:H4444444s

    Score
    10/10
    gootloaderexecutionloader

    • GootLoader

      JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

      loadergootloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks