guloader | 181152eb6d75fa9dfbf1005e791114b7778ef167df37d74fb01a81a959d3edd7

General

Target

0fb539ce6cbe08fae40b7395c70dcdf0N.exe
Size

808KB
Sample

240819-scmx9s1aqd
MD5

0fb539ce6cbe08fae40b7395c70dcdf0
SHA1

a390a4f8b4851dae30f958b0ff3af95bcf4d67c1
SHA256

181152eb6d75fa9dfbf1005e791114b7778ef167df37d74fb01a81a959d3edd7
SHA512

a582398119d4eec04a3956f8dc2da12d9fce8336763acf50c10776910c61dafa646e929db68279faae164f254ca8027d36a2ab8112c31b9facfdc2adf7f4e189
SSDEEP

12288:HXDLCvWu9hsxUJE4dKu7wdc8HAQhrNPVuzoN:HzLUhsxUioKukdc8HA+FVuz6

Score

10^/10

Malware Config

Targets

- Target
  
  0fb539ce6cbe08fae40b7395c70dcdf0N.exe
- Size
  
  808KB
- MD5
  
  0fb539ce6cbe08fae40b7395c70dcdf0
- SHA1
  
  a390a4f8b4851dae30f958b0ff3af95bcf4d67c1
- SHA256
  
  181152eb6d75fa9dfbf1005e791114b7778ef167df37d74fb01a81a959d3edd7
- SHA512
  
  a582398119d4eec04a3956f8dc2da12d9fce8336763acf50c10776910c61dafa646e929db68279faae164f254ca8027d36a2ab8112c31b9facfdc2adf7f4e189
- SSDEEP
  
  12288:HXDLCvWu9hsxUJE4dKu7wdc8HAQhrNPVuzoN:HzLUhsxUioKukdc8HA+FVuz6
Score

10^/10

guloader lokibot collection credential_access discovery downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral3 behavioral4