Extracted

• • Target

    sws.doc

  • Size

    27KB

  • MD5

    418aefdb083ce19b972f4573f3ed98ff

  • SHA1

    bd9dde0f672a66ac0da55b00106c713aefe693f1

  • SHA256

    e6d3f9dc2815e9f7604382a83ffe91cb49a32b2c7866ce9a321a1fb4c35c49e9

  • SHA512

    0c564b655f0fe783951a1a105e479a799708c5e7269ec756fe3c5ac89f116394fbd8c924f3e11cfac051c87213032a9056568df63fa37d1920354e204fb76426

  • SSDEEP

    768:xeXX2cCsj02PMV9v4ovzJeBAE9o8W7ShmIHVNR3GyOwmEU:xC2cCsY2EVJ4ovBD7ZCbcEU

  Score

  10^/10

  guloaderlokibotcollectiondownloaderspywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2