General
- Target tmp1iy8afcl
- Size 23.2MB
- Sample260602-sxt73sas9r
- SHA256 0c71b32d1c629ae6e7a05b8919436c09f46aa7195af3efccc8f4863637b5450f
- MD5 e394576835ce6bdaa8f58d2f0b8162bd
- SHA1 b96db5850314d7e347d524d1fb1fbea6d280986e
- SHA512 328ee5cc9fa174f344f8a908a8df3f4da35a94347c34fe6a998030d6232ec5d497d8807df782c0f3a35e350f5f17bc80e8f28102385b681a5803647f54e2df59
- SSDEEP 49152:wY+08dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDbY+08dPXWR4ba/JOtE:zc43mNc43mNc43mNc43mNc43ml
- TLSH T1AB37A2E9FFD52062B622726E5F5FB14AB33880175A49DC907C0CD4647B54B2883F9BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
tmp1iy8afcl.js
Resource
win10ltsc2021-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp1iy8afcl.js
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp1iy8afcl.js
Resource
win11-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target tmp1iy8afcl
- Size 23.2MB
- SHA256 0c71b32d1c629ae6e7a05b8919436c09f46aa7195af3efccc8f4863637b5450f
- MD5 e394576835ce6bdaa8f58d2f0b8162bd
- SHA1 b96db5850314d7e347d524d1fb1fbea6d280986e
- SHA512 328ee5cc9fa174f344f8a908a8df3f4da35a94347c34fe6a998030d6232ec5d497d8807df782c0f3a35e350f5f17bc80e8f28102385b681a5803647f54e2df59
- SSDEEP 49152:wY+08dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDbY+08dPXWR4ba/JOtE:zc43mNc43mNc43mNc43mNc43ml
- TLSH T1AB37A2E9FFD52062B622726E5F5FB14AB33880175A49DC907C0CD4647B54B2883F9BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.