Extracted

• • Target
    documentos transferencia.js
  • Size 1KB
  • SHA256 90f157c99308fb56084227d0dbd68fb272f4ecdc2a6c30cc174d39cc4d1dd540
  • MD5 3cf68f0b6132dc80f63f25f488a7822f
  • SHA1 58cb57caf9d1a10926e3b70a3bc8726f3cbf6f97
  • SHA512 377c1887756d3f6cd3d9633e302ac3dbcadadaa3c6d65d8d49a8051eb40fc87f5c7efcf13e768719a6359b2680a052acd38777d3e10e6276552806aa424118d0
  • MD5 SHA1 SHA512

  Score

  10^/10

  guloaderlokibotcollectiondownloaderspywarestealersuricatatrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2