guloader | 2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152

Sharing

Copy URL

Twitter E-mail

General

Target

2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152.exe
Size

492KB
Sample

240625-bh2j6svhpl
MD5

daefc1d031c8aaa70bc98e08278792c0
SHA1

148d0b47ec294971d0a7bc64b93e21c15048ad75
SHA256

2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152
SHA512

e9831ed53ef93d401fcf870dfe943e9ce76bf01deedba4db46d8860b638432445b6e7b13c639b2dd6dc8df7d1b82c57f1325aeba27816cd6d6d108dea351293c
SSDEEP

12288:Tqgow1LlsfJfmAhRRwXyx+B7JgyD9qhIVa5LkS:N1L+fJeAhRiix+lJgyZXVa5R

Score

10^/10

Malware Config

Targets

- Target
  
  2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152.exe
- Size
  
  492KB
- MD5
  
  daefc1d031c8aaa70bc98e08278792c0
- SHA1
  
  148d0b47ec294971d0a7bc64b93e21c15048ad75
- SHA256
  
  2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152
- SHA512
  
  e9831ed53ef93d401fcf870dfe943e9ce76bf01deedba4db46d8860b638432445b6e7b13c639b2dd6dc8df7d1b82c57f1325aeba27816cd6d6d108dea351293c
- SSDEEP
  
  12288:Tqgow1LlsfJfmAhRRwXyx+B7JgyD9qhIVa5LkS:N1L+fJeAhRiix+lJgyZXVa5R
Score

10^/10

guloader lokibot collection downloader execution persistence spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/Banner.dll
- Size
  
  4KB
- MD5
  
  843657eaf7240b695624dcf38bb0eb31
- SHA1
  
  ca99a44e737fdeaab56f864ce1ef15a57d2eec90
- SHA256
  
  b935d14c32ad8e16055f7f5794ac3411e601c5ac93155afc623f25b08e2ab82e
- SHA512
  
  7773d9f6bbd17253d1c96ce225b2f9d3673969b38177afef236d1c5d4aabaae2c07793e07c34f0281ec3b859ae955e83bfe43a598ce7cc6c893ec8c9604f5de3
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/BgImage.dll
- Size
  
  7KB
- MD5
  
  a98576f0d6b35b466cb881860977fdbc
- SHA1
  
  28b3dbbd76f15c876b98dce523100aa3256d193a
- SHA256
  
  6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
- SHA512
  
  29225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c
- SSDEEP
  
  96:8e70AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk7nLiEQjJ3KxkP:tBBfjbUA/85q3wEh8uLmqLpmP
Score

1^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  2c84faebfda2abe3b16fdf374df4272f
- SHA1
  
  a5b0258a94e0440aefe1ef320e62e7a9a1c8bb40
- SHA256
  
  72b38e4cca0af336655d55501c4ea05080baaa9921a62a2d717afe90bb801004
- SHA512
  
  207164cc6914c59d9f4f3b8ae97628c544093ba6ecda9f8da351f453cd97e03be7a640264b8686b2d5e6f3c787f4df1d8a1ebc8e51fd788a97460cd981cc015e
- SSDEEP
  
  96:3ip41CMj95rKhkfL5RkEdKkcxM2DjDf3GE/E9v5E9av+Yx4QndY7ndS27gA:3iujesS4HRE/K5MYxBdqn420
Score

3^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Lokibot

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Accesses Microsoft Outlook profiles

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8