Extracted

• • Target

    Shipwrightry217.exe

  • Size

    554KB

  • MD5

    f8907e4492367a471d4883b2bb07c2ce

  • SHA1

    eced4f9dd7e9dea0d6836753cc55042dac7b9aab

  • SHA256

    4ec2fd690c7b8eca3ef9a7a2624672f7ef09f75985922656ab588062ec1212ed

  • SHA512

    b1ce16feb0062baf2744848a752b7baf8326776b0594233b17c280316c7b4d39a3d01df48037eb049c95cbb708416ca9e41911a449a610e627358902283bfa3c

  • SSDEEP

    12288:cqp+8Qve8l8/bB84fFVubbn8XfG0xTzLSS0/K779NKKc06Kux:48Ue8l86GFIbn8XppF58h06Kux

  Score

  10^/10

  guloaderlokibotcollectiondownloaderspywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2