gootloader | 9149f8b2afe9f24692b628c0c014ccbcccb7b54561e4ab544656c83164a3f279 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

water escr...912.js

windows7-x64

water escr...912.js

windows10-2004-x64

Sharing

General

Target

water escrow agreement 77912.js
Size

19.3MB
Sample

241017-rqmc8a1bqg
MD5

67da9c54b9fba4ded6d308dde26f8ff8
SHA1

6c67286c6f33e2110e3db8c8240a491506313668
SHA256

9149f8b2afe9f24692b628c0c014ccbcccb7b54561e4ab544656c83164a3f279
SHA512

11a3070294d948c716a0a6321f1c7967c31a09117b61f022537fb98f4849f10c0f6f3357438165efed937b25679d85f9be19f5204610ed0476c6eab525974d9d
SSDEEP

49152:j7BRzjCxbUqHlp4nv5N0+ChM/5bzSYzYBBji+8j3d3O6/+PQGoI13qu2FJEYcE2W:X

Score

10^/10

gootloader execution loader

Static task

static1

Behavioral task

behavioral1

Sample

water escrow agreement 77912.js

Resource

win7-20240729-en

gootloader execution loader

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral2

Sample

water escrow agreement 77912.js

Resource

win10v2004-20241007-en

gootloader execution loader

windows10-2004-x64

10 signatures

300 seconds

Malware Config

Targets

- Target
  
  water escrow agreement 77912.js
- Size
  
  19.3MB
- MD5
  
  67da9c54b9fba4ded6d308dde26f8ff8
- SHA1
  
  6c67286c6f33e2110e3db8c8240a491506313668
- SHA256
  
  9149f8b2afe9f24692b628c0c014ccbcccb7b54561e4ab544656c83164a3f279
- SHA512
  
  11a3070294d948c716a0a6321f1c7967c31a09117b61f022537fb98f4849f10c0f6f3357438165efed937b25679d85f9be19f5204610ed0476c6eab525974d9d
- SSDEEP
  
  49152:j7BRzjCxbUqHlp4nv5N0+ChM/5bzSYzYBBji+8j3d3O6/+PQGoI13qu2FJEYcE2W:X
Score

10^/10

gootloader execution loader
- GootLoader
  JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
  loader gootloader
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gootloaderexecutionloader

behavioral2

gootloaderexecutionloader

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.