gootloader | 8b373a2ac09cd9456ce492a2d15e270a02984b0cce5d4a7e8d98c0825791707d

Sharing

Copy URL Twitter E-mail

General

Target
skitz-pc-agent-windows.zip
Size 33.0MB
Sample260928-w93a1ace79
SHA256 8b373a2ac09cd9456ce492a2d15e270a02984b0cce5d4a7e8d98c0825791707d
MD5 45a7d503652491c3e6e59210a645cb3d
SHA1 95cbadc453451045093054969f543729c0b66ab9
SHA512 7e076113bea7d586999e0f9cac1c71927cce9e26b3b18965172402ec5a142c14c723de8e89b7b4becec6ffebd41ec0b4477364a172e869aaae5bea5ef8bb8aa9
SSDEEP 786432:mK62zNPlsmTzbd9go9ByhwJdri3cpl7DpDQyayA0mpWxm3Id0HNI:V62zN2mTzxp9BjJxi3cpZna3umM0tI
TLSH
T15B77339CF3FA9ACFD03B4D4492D45D1B492A51626E71AD339B0D33DA88FF2CA9790448
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SkitzInput.exe
- Size 8KB
- SHA256 2fcf3c7df39af08c229411145c19753c8f83383f588bdf75b7e5696bcf1692f8
- MD5 7cf7cea630962582c8c1d41f89ec4852
- SHA1 662e23e451b4692793bd6f1b57e088ee037a9655
- SHA512 6c53b89ace87f0496dd23470a635ee0b77faf7631a55ca01b0c035ec01bd4edb1c602f26657e3edd3f6ec464f8b3fd4c00e26926630d393d4400a2273b7c6b45
- SSDEEP 96:ksz4xl9eScENt2hPJD/KO7q6//xf1Q8u2VHccVBu2H/i+vWoxvBmCgg2xzIq/SvS:hzXWydJzKOh53H3VhmpDIqy6/
- TLSH
  T19A020C06A3EC1A3AD4EE5BBD49F302213330E95A3A53E35F24ED50A9A77A39157503F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  SkitzMedia.exe
- Size 11KB
- SHA256 79bf16bec7fc6b451820451b08c7e2697714b3e0bb9a13470f5bf81b982bacef
- MD5 0d4b751204ac39b912aac9f85aca0bc3
- SHA1 a1cc1db12a01f67e2597e5e7433e1c53083e8cd1
- SHA512 0461864405f4bb99186f20eed92e22bd70a6e4c7807710e722a8a9f20627df109754cc3013604bc7188909aedbbe4a2529dd172cd2a6fe9460b54e72d8d1c282
- SSDEEP 192:NRLXl0cdUQbG9YYA6Isk+H/HIEVD+stxs/DrTXMPhwSgOt:TCsqIsJHZD+r/DXIwSgO
- TLSH
  T14332F86C97FCC527E47E5B3DA6B243221B31B95AB825E70E1ECC0CCD6A523014652BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  SkitzMirror.exe
- Size 6KB
- SHA256 3086884b089fd4137f29be3d02eb02c4a3a9acb9792cdf4ddfefd5965a64a151
- MD5 34acab77819da441afa9c0d04cfa7063
- SHA1 d7bdc8148775cc962236accf75ffbdf7c5fe9970
- SHA512 e0131cf2d44b9c891a25042dd0ac79d2ed69d42513133bf9b6c886b20f7ed283dd44d31db26064601ca54090768bf85170068cfb29b9d6a576e50d278f8d29a3
- SSDEEP 96:w5Z+OrmS/2PCzeVEhN+z9iBoQ8E2b9KzNt:GwSmE6VEhN8wBoQ8Vs
- TLSH
  T17AD1C41A73E8C553F8AE0B3978F34B04937196515AB7EB8F3EC4011A6EB77400A6B360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SkitzPcAgent.exe
- Size 32KB
- SHA256 08a3fb2337278a255827eb206e6e9e560335791d2a5ad2aacde82c317879c1a2
- MD5 528e292271425730d65286199a1d2e80
- SHA1 fe69c9b3070a426473343d16035458e938f139c5
- SHA512 d29a9073ff46c4563d1db840c9745629f5888d48889781fc50444a992523a02d8358bdabf66c980e5bd9865e8cb5c99e929f368e6052585ff2b4f4309fde8844
- SSDEEP 384:iE1Erwigzj6vRy2pzPz9KEubEzDsD6yr6qAuu/iYlaAxSg6ABHon8R6oHPLlOwgx:BJ6pyasbvAgGDMI9L1qRv6Y
- TLSH
  T138E2E80537E88B14E5FE6FB81932416017B8FD579932E70D0EE954ED0DA3B90C9A8B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution gootloader loader persistence
- Family: GootLoader
  JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
  loader gootloader
- Adds Run key to start application
  persistence
behavioral7 behavioral8
- Target
  node.exe
- Size 88.2MB
- SHA256 9a4eb5f1c29c6a2e93852ead46b999e284a6a5ca8bab4d4e241d587d025a52de
- MD5 6ed74834b16483725fd157afaa72cc43
- SHA1 f8ed866bf1ec6ccaa346048efee80f51d0133e5d
- SHA512 042b0456017ce4573d3cf78d7015c9af88fa58c64ff418bd59dccdc9d46cdb0ff3f655cbf07de6a25d218730f7ae005c12e2569a4bcf17651ce8950e0f6d8507
- SSDEEP 393216:yH0Qt4U5pyl5wyC4UFbc1eAg68OGLalPooBH7LVBEdGiTBxFSsiXUx7WT0wWlF3P:yHDmSol5nUX68lL0H9mdG7egURGA
- TLSH
  T121187E13B3A705D5E8FBDA3196E65123A932BC066F3185DF324C17261F73AE05A3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  qrcode.min.js
- Size 20KB
- SHA256 c5144bd3cb29355cd88c490af351d8833d4e44399452a46c94c018dfc02b092e
- MD5 f2fd53850930aefd93c20f7a3d88b1e4
- SHA1 7aab6a4c013469f01a62603c16dde2514d6ddb93
- SHA512 4ca7a3797bcfe25f6c10f2e467c1204d574fcbc384c2203bae6612384a75f750f0a06628ed9ef80a217f6d8e172bac9800b4270bc13c09a532c30196ed26b15a
- SSDEEP 384:AaP4fzjgPa+UnqrVps/af5RN9lHtAAdTRD4gUF4DRE4Ffe37nHHqsglqSX6bG8Sm:QgPPUn6FlHmF49E4F237nWZ38BBO8
- TLSH
  T11A92B695F3C9A2A55395ADE2081F108BE178DC627C1A8158FF32C4D2ACB4BD5943BF78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  system-scripts.mjs
- Size 3KB
- SHA256 0cefcc9a95748ce5865bd506df6d9efcedcbd860f8efb2db1424faba68435e38
- MD5 a49b2e0d6a200c1a5b4e8f2b668ef1ac
- SHA1 f2d295a184bb08526545422b6b67151989601b50
- SHA512 36c812075bed7db7ddc0c6bfc4505b9e034ae0c1a7d7ddedb55766a2549979909aa68bc2925c0386e322a0cc7dcf6c1f42277e684c51779a6a946b4777325fb8
- TLSH
  T1668184303147907649B6629DFFC68440EF37D2A615DE20C0B4DD8AD2EFBA95B8235FA0
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14