guloader | c384d26e83f585fbadd73e6cea441d1479d68de5bb647f775b506e5eab7f3230

General

Target
RFQ-SulselBarruII2-COALCOMMLDOC.exe
Size 647KB
Sample240403-e8z1tagf43
SHA256 c384d26e83f585fbadd73e6cea441d1479d68de5bb647f775b506e5eab7f3230
MD5 90fda5c072fe00e8e737606add7f1276
SHA1 68752dce786a29b815ec5454d4b4aa5f6bc73363
SHA512 df854ac565c084d47bc20e738ee8f36cf040d33fc2b7cb7c8ab84a83b2d77308b522eccd81e23e576bb9f82bf1ea00a50f33435522d8d2070923de0a862a2512
SSDEEP 12288:IgXRAvufNFTr7L6GJpk/0C+wEc80Qu8j4RmYxrqwDwmuu6TNxFu+b:jXRyUNJr7L5vBC5ummYxrPqu6hxFu+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  RFQ-SulselBarruII2-COALCOMMLDOC.exe
- Size 647KB
- SHA256 c384d26e83f585fbadd73e6cea441d1479d68de5bb647f775b506e5eab7f3230
- MD5 90fda5c072fe00e8e737606add7f1276
- SHA1 68752dce786a29b815ec5454d4b4aa5f6bc73363
- SHA512 df854ac565c084d47bc20e738ee8f36cf040d33fc2b7cb7c8ab84a83b2d77308b522eccd81e23e576bb9f82bf1ea00a50f33435522d8d2070923de0a862a2512
- SSDEEP 12288:IgXRAvufNFTr7L6GJpk/0C+wEc80Qu8j4RmYxrqwDwmuu6TNxFu+b:jXRyUNJr7L5vBC5ummYxrPqu6hxFu+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader lokibot collection downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Graustark/resultalet/Unmeringued.Brd
- Size 60KB
- SHA256 8559f472b29a2d1de1124b1b2aa6d62558b1207a3910048d77b9bb07501e3733
- MD5 8418ca27cc3391358049989e80076a60
- SHA1 0ca1bae9dfabae917324af7337d1ed8c2b6001aa
- SHA512 b6ee3a45200b5f218520c38fbde6b6a30e4f2e847ea890ace3b37a38b14f2c26ee12f21c350052336c67ac725233f1e5b65b1d0b5a4343ef0fca50214b96c01f
- SSDEEP 1536:FNKL+KTusOLdVQxd5B+n51ZPsXb7VZcrq/qhgPqpba5Znn:FNsl9Ud2u1ZP87ViQSpyBn
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4