Extracted

• • Target
    3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe
  • Size 463KB
  • SHA256 3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f
  • MD5 a781a01bfff6c0648192f32cdcd2ebe8
  • SHA1 586d0bd97d1996749531127dd9a406aa186ae7ab
  • SHA512 ea925a413709f04443c92779f736a6bfcee0a0d6653709cf0fb952fde2d72f2fa7aa0880031bd3c3da396afab462b1c5b8492618ea9ab0ac6ec2b83e643c91d0
  • MD5 SHA1 SHA512

  Score

  10^/10

  guloaderlokibotcollectiondownloaderspywarestealersuricatatrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2