Extracted

• • Target
    003documentos transferencia.pdf.scr.exe
  • Size 463KB
  • SHA256 076eee978cec1be476b4e103c42ca6081b8f6f73ddccdee87998df2f3b665f31
  • MD5 bac8f1039c4f51b99d537446c27ab143
  • SHA1 cab53e88cf72a9d7498ee8579707189296c1c5ea
  • SHA512 f0e2b5349e2e45be50890dd2066bedf81441118d77a9e12ec32f1f0d1a87a08fee46c909f0d8bb622c23047ac52c1149c56ab369ed60ebc9a14d7be0ef5fd494
  • MD5 SHA1 SHA512

  Score

  10^/10

  guloaderlokibotcollectiondownloaderspywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2