General
- Target RFQ(National University of Mongolia) 2305ASI .exe
- Size 396KB
- Sample230518-3fefeaeb52
- SHA256 7452b5e1aa5ea4fede44327fe843fe683bcd65ad31872c4eac344182f91c5a37
Score
10/10
Malware Config
Targets
-
- Target RFQ(National University of Mongolia) 2305ASI .exe
- Size 396KB
- SHA256 7452b5e1aa5ea4fede44327fe843fe683bcd65ad31872c4eac344182f91c5a37
Score10/10Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext