General
- Target Request For Quotation Details_Ref.exe
- Size 949KB
- Sample240325-pp46jaae5w
- SHA256 b67c5941b8a82c44ee8c876e53fc0435d8d5653491b6c61ef0ec5ee92bbfbed0
Score
10/10
Malware Config
Targets
-
- Target Request For Quotation Details_Ref.exe
- Size 949KB
- SHA256 b67c5941b8a82c44ee8c876e53fc0435d8d5653491b6c61ef0ec5ee92bbfbed0
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Accesses Microsoft Outlook profiles
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target fangelejre/Syrnes/Lnforbedringens/Hjertensgodes.Nim
- Size 59KB
- SHA256 f817a40978e642e98d2c41c967c651051414291fa729ff3618a8c12638cf566c
Score8/10-
Modifies Installed Components in the registry
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.