General
- Target tmp75onr81u
- Size 7.4MB
- Sample260602-r1972ahs3m
- SHA256 e3cfaec0a40be3786acb91921c83e6f591aadaa34592dd03055affcdddc268e9
- MD5 d1fb4b18630cd5d0f689707c3d96eff2
- SHA1 4125afdfb27cf3a0f56639eff17c32f3f1c153f2
- SHA512 0531dbab919b4d50ef8849893b59b01b1167d30427dd9ccc26aa0f9e4c0825f04e06fcd85edfd02dc74f8c537c0b57fdb33fa72f995e20515479923852952be5
- SSDEEP 49152:tYsZ+9yFbEc6GhQe5C5l+4SSNRLFjzW03NZPn3SbYmGBl+Kn8P4BlwUC3kiQijsk:g3D3D3K
- TLSH T14B76B4C9EBED254A955631198C3E24CF503DA477A8058CAFBC6CE1DC25E983C836DE78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
tmp75onr81u.js
Resource
win10ltsc2021-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp75onr81u.js
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp75onr81u.js
Resource
win11-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target tmp75onr81u
- Size 7.4MB
- SHA256 e3cfaec0a40be3786acb91921c83e6f591aadaa34592dd03055affcdddc268e9
- MD5 d1fb4b18630cd5d0f689707c3d96eff2
- SHA1 4125afdfb27cf3a0f56639eff17c32f3f1c153f2
- SHA512 0531dbab919b4d50ef8849893b59b01b1167d30427dd9ccc26aa0f9e4c0825f04e06fcd85edfd02dc74f8c537c0b57fdb33fa72f995e20515479923852952be5
- SSDEEP 49152:tYsZ+9yFbEc6GhQe5C5l+4SSNRLFjzW03NZPn3SbYmGBl+Kn8P4BlwUC3kiQijsk:g3D3D3K
- TLSH T14B76B4C9EBED254A955631198C3E24CF503DA477A8058CAFBC6CE1DC25E983C836DE78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.