guloader | 1950929ecf6f394abd7836cbb0c7019eef82bb9a31bbba1fc0e4541329311a36

General

Target

message__bac2e5d59db13df025382d94304d4d9b_list_waseda_jp_.eml
Size

965KB
Sample

220907-p4sfaahdan
MD5

54222baac6490cf132ab916923ce95f3
SHA1

5fe029ae55ad05a0c5f5abca1b525a9699603b93
SHA256

1950929ecf6f394abd7836cbb0c7019eef82bb9a31bbba1fc0e4541329311a36
SHA512

001d899374052f3b9b42efd48da357487b50674e483ba7ccc1ef28992e7d46f6dcc7271a9e1e3cd2807cf6b429b98876a92261958d3fd15438779db533a7ff32
SSDEEP

24576:E5nsbArNBJO18NsYYmw9G0KLRQmbDeqAVcMv:Z71weh

Score

10^/10

Malware Config

Targets

- Target
  
  見積依頼 (早稲田大学) 07- 09-2022.zip
- Size
  
  318KB
- MD5
  
  01db45f26466ada3b8387b4dcee03818
- SHA1
  
  7ac24dc24897b2f2c3a0980fd84338d12c013eb1
- SHA256
  
  551d4c10edeb05fa91f59d9846448d647324bd1c3eb1def27476c5a86a5ea6cd
- SHA512
  
  e370867d7deb5dfbc9f92d63803fc02735d2efc08519ec4c5f601cdf8db69ac89cf2f6b9927bfc633a9d89fa36723a47b5393544df55d0a583a9bb51d388376b
- SSDEEP
  
  6144:jklj43uTs6JUa9VErPFYYUuqGtxsHdVQkGgSHclEWOCAYT:ju4os6JFVoFPrtxsX7GgOcWCAYT
Score

1^/10
behavioral1 behavioral2
- Target
  
  Request for Quote (Waseda University) 07- 09-2022.exe
- Size
  
  346KB
- MD5
  
  d12d4496e0c394e323d868eaacee34c0
- SHA1
  
  58e7b6580dea94b97c941bb9db2aec0e4c286671
- SHA256
  
  28f818c30c5454354433cae559cc16ca5430dc9fde6776a4e252e99d8f39c370
- SHA512
  
  5713b7db874e5bfd23b218c571ecacb72de14218a2e3b1dc26bbe39df4fd3698d7b851089aca707ba0eb3877449d72224f4a096cdfb5f4169cbee2db117b97f6
- SSDEEP
  
  6144:6/c/43AbmhXUQirdrt9ENYoTvGfKPGneuxIuwsHdVmkGgSrcVEUoI:6R37XUTrdp9SYYOfKeneuS3sXNGgMczN
Score

10^/10

guloader lokibot collection discovery downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3 behavioral4