guloader | 4732e92d6638b09039e9e7996b76140dc90b4a859cd235848d15a088bf66b554 | Triage

Sharing

General

Target

BUDJET TALABASI 09-05-2024·pdf.vbs
Size

33KB
Sample

240905-s8stdsvcjg
MD5

d6d85ff7c492d503ac64611c60a1dfb4
SHA1

51e4f21f2a660c911a6dcfd6a15a2154d8a81144
SHA256

4732e92d6638b09039e9e7996b76140dc90b4a859cd235848d15a088bf66b554
SHA512

48c89076a84a16151195e0782e0f4721366407387b286ad07733db52f44f6ba2e567669fe3d850a550f5eaba98de7a3aa4450d16b715e4cde05d0837db9fd172
SSDEEP

384:rHPrJTpo7PC5xZ1bfsXsjlc46z/WnIM/0LfAmAnNfEbrpKz4M:rHP1Z5uXsZE5MijA

Score

10^/10

guloader lokibot collection credential_access discovery downloader spyware stealer trojan

Malware Config

Targets

- Target
  
  BUDJET TALABASI 09-05-2024·pdf.vbs
- Size
  
  33KB
- MD5
  
  d6d85ff7c492d503ac64611c60a1dfb4
- SHA1
  
  51e4f21f2a660c911a6dcfd6a15a2154d8a81144
- SHA256
  
  4732e92d6638b09039e9e7996b76140dc90b4a859cd235848d15a088bf66b554
- SHA512
  
  48c89076a84a16151195e0782e0f4721366407387b286ad07733db52f44f6ba2e567669fe3d850a550f5eaba98de7a3aa4450d16b715e4cde05d0837db9fd172
- SSDEEP
  
  384:rHPrJTpo7PC5xZ1bfsXsjlc46z/WnIM/0LfAmAnNfEbrpKz4M:rHP1Z5uXsZE5MijA
Score

10^/10

guloader lokibot collection credential_access discovery downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderlokibotcollectioncredential_accessdiscoverydownloaderspywarestealertrojan

behavioral2

guloaderlokibotcollectioncredential_accessdiscoverydownloaderspywarestealertrojan