Extracted

• • Target

    67434f853750f35f663aea7c2a731961d02557766d0fb6492b86c5e4a155f560_JC.exe

  • Size

    611KB

  • MD5

    f0cb496455bccd4d06798a9df0c02a00

  • SHA1

    d670e1ba402a255b11a5844609990001f9a5c592

  • SHA256

    67434f853750f35f663aea7c2a731961d02557766d0fb6492b86c5e4a155f560

  • SHA512

    4adb1d0c23429a840f7da8c9a09ba34cdfe3393f25e4160ea8b75566aa304eebf2f240ecd6ba93c6fcbc5fb9fac1f67d3c330b7d8d793d640ae928f3b10a8e2c

  • SSDEEP

    12288:OBfIP7r9r/+ppppppppppppppppppppppppppppp0YudNUskOrzzMGEIg9ZanxuG:T1MudTkONy9Zanxs4AANR9

  Score

  10^/10

  guloaderlokibotdownloaderspywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2