guloader | fd30f7ab4666cc087bccd6d822a363527c1e64ce68872cf2abacca079ad12663

General

Target

7b01307279c1999f5cc654f75f4d7256.bin
Size

72KB
Sample

240329-crkhpafb3z
MD5

fb4c572287d562e2eabc0878d6f73c46
SHA1

261a8c08c7f39a980e06e52f759bcdbc9b5aff13
SHA256

fd30f7ab4666cc087bccd6d822a363527c1e64ce68872cf2abacca079ad12663
SHA512

81fed6f1ac50a3e06bd64682615067de908712261a16563739d2d7a92792867c52e1d0cbee82d2fca9184a338b0672c42a9f513df27389cb8a0ed37f3c252363
SSDEEP

1536:cGcZIX4pMnWwgAzw5ajb0gX9YEZMeDPFIAKKS:yOX7WwgzajpNpOgaKS

Score

10^/10

Malware Config

Targets

- Target
  
  f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs
- Size
  
  178KB
- MD5
  
  7b01307279c1999f5cc654f75f4d7256
- SHA1
  
  c6c3c841ca9448c605bae111b74a3d1f9b84788b
- SHA256
  
  f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a
- SHA512
  
  01e1c07910f9a0ac077a0c61e27df9af7d90d9070e6cfcdfa1356b78fa608d26b19bafd84f325595c1b1306cec9aebadfffafcabe47639d1b49bbb90eb1cf733
- SSDEEP
  
  3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hy3:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVQ
Score

10^/10

guloader lokibot collection downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Lokibot

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2