gootloader | 9b07a2200dc4ad3e3f50393a021dbca70e7bb18565ef99a41d877b2c3ac9a21d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpgfbvhmg7.js
Size 255KB
Sample260523-efn3vaez9x
SHA256 9b07a2200dc4ad3e3f50393a021dbca70e7bb18565ef99a41d877b2c3ac9a21d
MD5 7d2b4deed92f944ed5c6c932e63785c9
SHA1 9129c2f8fc2c89c552a10992c0a1b19b830408f2
SHA512 493d3283e4de28988b51d2ce2b63b67af3c96eaad2ea4d9355efd0c03dc5139292a1582a26a51f1ff0b9cc8a33e287b7531bc39f8af585d6098886042acb5737
SSDEEP 6144:ygLfh6nWcr8uV1Tdp2YmDSrFEFyFgvL/2VX82yLwIPflhADG1+RH:y3AYmDImFy7s93PfHADG8RH
TLSH
T13644B5D8F78D112E423231AA9D2F52CDBB7CD1B1560458AEBD4D497C24A083C42FAF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution gootloader loader

Malware Config

Signatures

Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
63	2544	wscript.exe
65	2544	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	65	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	63	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmpgfbvhmg7.js
1⤵
- Badlisted process makes network request
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads