guloader | 08f0bbe6555c48db42f8c443f75454df8cff5202aed71bc68ff2aa50f553f65a

General

Target

08f0bbe6555c48db42f8c443f75454df8cff5202aed71bc68ff2aa50f553f65a.vbs
Size

674KB
Sample

240409-bdlyxscg5v
MD5

b58a6acfd4547e8c4807ecf021d66836
SHA1

23d24358058fe6d64d4f9386775970be4ce9d22b
SHA256

08f0bbe6555c48db42f8c443f75454df8cff5202aed71bc68ff2aa50f553f65a
SHA512

bdc869db4096071268742aa0e29862712454317801b15c1fbe40c0e6e1ea466a34debb5d2f064d4a0e2369bec2e2b9e92c3aa23922bdcc7b8e7164108bbe3b8b
SSDEEP

12288:0KR3TAwEzevvk5tZ2e9ET/EVuoKPcthUh6sHpA:0y31GevaguET/EIcthItA

Score

10^/10

Malware Config

Targets

- Target
  
  08f0bbe6555c48db42f8c443f75454df8cff5202aed71bc68ff2aa50f553f65a.vbs
- Size
  
  674KB
- MD5
  
  b58a6acfd4547e8c4807ecf021d66836
- SHA1
  
  23d24358058fe6d64d4f9386775970be4ce9d22b
- SHA256
  
  08f0bbe6555c48db42f8c443f75454df8cff5202aed71bc68ff2aa50f553f65a
- SHA512
  
  bdc869db4096071268742aa0e29862712454317801b15c1fbe40c0e6e1ea466a34debb5d2f064d4a0e2369bec2e2b9e92c3aa23922bdcc7b8e7164108bbe3b8b
- SSDEEP
  
  12288:0KR3TAwEzevvk5tZ2e9ET/EVuoKPcthUh6sHpA:0y31GevaguET/EIcthItA
Score

10^/10

guloader lokibot collection downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Lokibot

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2