General
- Target tmp18tmdp3q
- Size 16.1MB
- Sample260602-tf47dsaz8r
- SHA256 d4de04e7ad3b74b1966f60dcabdd16f1283df22a7e24625352f8585aaf6cfae6
- MD5 a5b98b1d4a728e0a27c8461cdf20b84a
- SHA1 c21645ed5431ad82f4508f726e99d7b5219c4dbe
- SHA512 ef1c4982ec8a5e6eb6c25659d6903156aeb9f826ab63b33ff265ab6744d085be67509f65bc0dc3ccb9d78cf201db2468413a8978cfe84bfdb609849666514e78
- SSDEEP 49152:o7BNzjCxbIqHlpkBhsN0ANhM4PnzdYzYVPc4+8OQK3sa/4TXGIX+C3qu0AFgfcEZ:uqqqqr
- TLSH T10907B20DAEF71091A923317C8FAF640AB6748017190ADD143D8DA3945FA953867FEFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
tmp18tmdp3q.js
Resource
win10ltsc2021-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp18tmdp3q.js
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp18tmdp3q.js
Resource
win11-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target tmp18tmdp3q
- Size 16.1MB
- SHA256 d4de04e7ad3b74b1966f60dcabdd16f1283df22a7e24625352f8585aaf6cfae6
- MD5 a5b98b1d4a728e0a27c8461cdf20b84a
- SHA1 c21645ed5431ad82f4508f726e99d7b5219c4dbe
- SHA512 ef1c4982ec8a5e6eb6c25659d6903156aeb9f826ab63b33ff265ab6744d085be67509f65bc0dc3ccb9d78cf201db2468413a8978cfe84bfdb609849666514e78
- SSDEEP 49152:o7BNzjCxbIqHlpkBhsN0ANhM4PnzdYzYVPc4+8OQK3sa/4TXGIX+C3qu0AFgfcEZ:uqqqqr
- TLSH T10907B20DAEF71091A923317C8FAF640AB6748017190ADD143D8DA3945FA953867FEFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.