Overview

overview

10

Static

static

1

unionoftax...442.js

windows7-x64

10

unionoftax...442.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    unionoftaxationemployeescollectiveagreement31442.js

  • Size

    9.0MB

  • Sample

    241001-bmh9dsxgkd

  • MD5

    ebc47d7b05d2cb462f3366cd0a62d595

  • SHA1

    41b1b09e348e0cea83c9840cef8565fbc15e40e4

  • SHA256

    aa69518515803dc5f4126950d94443f0bc281a71b08441b704e2459f4f3f8511

  • SHA512

    ccceaa7db00f1ad820b2171cbfefbad0e554a9c211527e934f364bef84241fe1f021cbd5dd2ac9f652dc84419260789d169d291657d09c6a5e2420e075302d22

  • SSDEEP

    49152:BjF0tlPV9PjF0tlPV9PjF0tlPV9PjF0tlPV9PjF0tlPV9PjF0tlPV9PjF0tlPV9l:aPVWPVWPVWPVWPVWPVWPVD

Score
10/10
gootloaderexecutionloader

Malware Config

Targets

    • Target

      unionoftaxationemployeescollectiveagreement31442.js

    • Size

      9.0MB

    • MD5

      ebc47d7b05d2cb462f3366cd0a62d595

    • SHA1

      41b1b09e348e0cea83c9840cef8565fbc15e40e4

    • SHA256

      aa69518515803dc5f4126950d94443f0bc281a71b08441b704e2459f4f3f8511

    • SHA512

      ccceaa7db00f1ad820b2171cbfefbad0e554a9c211527e934f364bef84241fe1f021cbd5dd2ac9f652dc84419260789d169d291657d09c6a5e2420e075302d22

    • SSDEEP

      49152:BjF0tlPV9PjF0tlPV9PjF0tlPV9PjF0tlPV9PjF0tlPV9PjF0tlPV9PjF0tlPV9l:aPVWPVWPVWPVWPVWPVWPVD

    Score
    10/10
    gootloaderexecutionloader

    • GootLoader

      JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

      loadergootloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks