guloader | 43517d5122fb62dbfcd0e8ab99010ece43d41ed58dc024868f77bc05a0a81612

General

Target
43517d5122fb62dbfcd0e8ab99010ece43d41ed58dc024868f77bc05a0a81612.vbs
Size 179KB
Sample240329-cmsnhafe22
SHA256 43517d5122fb62dbfcd0e8ab99010ece43d41ed58dc024868f77bc05a0a81612
MD5 9cc4d241f55c4430d7ca7245c585253e
SHA1 64497621d3145749d5d5b284448f8d7f90aa3e29
SHA512 4a058df7f657a75287b4d2a5a238469a83df4f160e246ea2240eedcf01bbf3d216a304e6cf0dba218c7a922099e60637e5650fe7f8037d350545939d0168f8f3
SSDEEP 3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyc:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  43517d5122fb62dbfcd0e8ab99010ece43d41ed58dc024868f77bc05a0a81612.vbs
- Size 179KB
- SHA256 43517d5122fb62dbfcd0e8ab99010ece43d41ed58dc024868f77bc05a0a81612
- MD5 9cc4d241f55c4430d7ca7245c585253e
- SHA1 64497621d3145749d5d5b284448f8d7f90aa3e29
- SHA512 4a058df7f657a75287b4d2a5a238469a83df4f160e246ea2240eedcf01bbf3d216a304e6cf0dba218c7a922099e60637e5650fe7f8037d350545939d0168f8f3
- SSDEEP 3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyc:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader lokibot collection downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Lokibot

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2