MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28bdcc80edf51591f6fdf1cdf7c334318f0ab4287b04a8774a202f2a1e396c57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GootLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28bdcc80edf51591f6fdf1cdf7c334318f0ab4287b04a8774a202f2a1e396c57
SHA3-384 hash: c334075efac15f85b9944b83813bdc9568d25783c303f2ed5309e4d2d581312138d906850882f535ee0ab4c3d40c3858
SHA1 hash: 4572512e00f7acd97e09e804b5f2cf5d6e900ab3
MD5 hash: f2e8775196d9140f5cde5ed18b458b31
humanhash: finch-apart-river-kitten
File name:Usmca trade agreement summary (84441).zip
Download: download sample
Signature GootLoader
Create hunting rule
File size:37'750 bytes
First seen:2022-11-16 13:50:27 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:kuz9vS362sC+sZQrizalLuhl3bpV6fPoC0d3KOitLukvG:dv54+CQizcCz1kPt0d3GtLuku
TLSH T1D303F19B0216EB89DF751CB5BD01660DB86FD6D625EC2986F20BE0F7D8A0510352E28E
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter GootLoaderSites
Tags:Gootkit GootLoader js zip


Avatar
GootLoaderSites
This malware is dropped by Gootloader/Gootkit

Intelligence

File Origin
# of uploads :
1
# of downloads :
265
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Usmca_trade_agreement_summary (klm).js
File size:100'658 bytes
SHA256 hash: 015f2bebd8b5cf2c1ab261e81c5151f2fe4b11806a648d7129e9f0870b1928e1
MD5 hash: 9ac4f7648d6434ca560d7077ea3816c2
MIME type:text/plain
Signature GootLoader
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL
Create hunting rule

PUA.SecuriteInfo.com.JS.Malware-1.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Link:
https://www.filescan.io/uploads/6374eac96fda73cab64e111d/reports/e0fd2901-ad27-4d41-be8d-eb0af7b886b1/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/28bdcc80edf51591f6fdf1cdf7c334318f0ab4287b04a8774a202f2a1e396c57
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28bdcc80edf51591f6fdf1cdf7c334318f0ab4287b04a8774a202f2a1e396c57/
Threat name:
Script-JS.Trojan.Cryxos
Create hunting rule
Status:
Malicious
First seen:
2022-11-16 13:51:08 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
6 of 39 (15.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fc64zahn6ukzd5x56hg7pqzugghqvnbipmckq52keaxsuhrznrlq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221116-q8vlwabf35/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
GootLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28bdcc80edf51591f6fdf1cdf7c334318f0ab4287b04a8774a202f2a1e396c57

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GootLoader

zip 28bdcc80edf51591f6fdf1cdf7c334318f0ab4287b04a8774a202f2a1e396c57

(this sample)

  
Link
https://twitter.com/gootloadersites
  
Dropped by
Gootloader
  
Delivery method
Distributed via web download

Comments