Overview

overview

10

Static

static

3

Ajánlatk�...df.exe

windows7-x64

10

Ajánlatk�...df.exe

windows10-2004-x64

8

Resubmissions

18-07-2024 19:34

240718-x98y8ashlp 10

18-07-2024 19:22

240718-x27q7awbnf 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ajánlatkérés - Heineken Greenfield Plant Project 07-17-2024·pdf.exe

  • Size

    549KB

  • Sample

    240718-x98y8ashlp

  • MD5

    ec67ad62fd11245af1b99b2d157f5359

  • SHA1

    de0ac7c5f66cbf75e3e7cb4faa07269639e1b46b

  • SHA256

    0553301c132cf8448f4fcaa99d7a57705d0824683547f303669eea418bf79729

  • SHA512

    7d9c206b36d8afbbf056e8aacbe92fe1cdb062fd194e026cdeab3f6f810750767d2200025d49c40ce7ef3b006d9f2774bb8a0cd028a243b63ebf15db504348b1

  • SSDEEP

    12288:tLfCKKKKKI1KFeGkSrsU6ydhrSbWbGf/KFWCvvew3mU8FlcxE3Xv/OIPjA2:tBEk6yamGfyZz8GA/OYA2

Score
10/10
guloaderlokibotcollectiondownloaderexecutionspywarestealertrojan

Malware Config

Targets

    • Target

      Ajánlatkérés - Heineken Greenfield Plant Project 07-17-2024·pdf.exe

    • Size

      549KB

    • MD5

      ec67ad62fd11245af1b99b2d157f5359

    • SHA1

      de0ac7c5f66cbf75e3e7cb4faa07269639e1b46b

    • SHA256

      0553301c132cf8448f4fcaa99d7a57705d0824683547f303669eea418bf79729

    • SHA512

      7d9c206b36d8afbbf056e8aacbe92fe1cdb062fd194e026cdeab3f6f810750767d2200025d49c40ce7ef3b006d9f2774bb8a0cd028a243b63ebf15db504348b1

    • SSDEEP

      12288:tLfCKKKKKI1KFeGkSrsU6ydhrSbWbGf/KFWCvvew3mU8FlcxE3Xv/OIPjA2:tBEk6yamGfyZz8GA/OYA2

    Score
    10/10
    guloaderlokibotcollectiondownloaderexecutionspywarestealertrojan

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks