Extracted

• • Target

    baca046e0c5667c8f2781be323953335.exe

  • Size

    1.3MB

  • MD5

    baca046e0c5667c8f2781be323953335

  • SHA1

    3ccd08ff28588cc26ea52a783c7202610ae832ca

  • SHA256

    3be658e5c91bcbded0777881592d53f65b182857a6dabf30c58245921272aae2

  • SHA512

    5466b7184bf12ebbc28ad7266292ed1039760c1fec509b705455d0bae50876c728852e686b3c15c723e752cbbb52b349aaea11612da502dbf81c4bf46112af64

  • SSDEEP

    24576:sPwOYizPEUm1z0E6G3VibpHIdebodR6jlKFtQVUv+iP8o79bO+3:sVxEUZG32poHRS2tQuWikK9j3

  Score

  10^/10

  guloaderlokibotcollectiondownloaderspywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2