guloader | d0ecf90dfee82cc205e9425c6702e3e2bf933e0d8236bf1c25291168f48e4560 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6d85ff7c492d503ac64611c60a1dfb4.bin
Size

7KB
Sample

240907-cazlaazbme
MD5

b027120066784c2fbb0796fd90686108
SHA1

6e792175755c12f639df6e342476c3feb1988aac
SHA256

d0ecf90dfee82cc205e9425c6702e3e2bf933e0d8236bf1c25291168f48e4560
SHA512

3d42a7437e8161ac09a02193d67578fad7482130e2e090b1b544fe5c1d1fe7382f5d3a1d678c5c9c40bfb71a288e234422dd3dcf9953a5df62aa13eb146cd767
SSDEEP

192:2pjrVEzmmKRQqJK6WCSFx300mxSWhK71rUV:YtumoUlWCScRNKly

Score

10^/10

guloader lokibot collection credential_access discovery downloader spyware stealer trojan

Malware Config

Targets

- Target
  
  4732e92d6638b09039e9e7996b76140dc90b4a859cd235848d15a088bf66b554.vbs
- Size
  
  33KB
- MD5
  
  d6d85ff7c492d503ac64611c60a1dfb4
- SHA1
  
  51e4f21f2a660c911a6dcfd6a15a2154d8a81144
- SHA256
  
  4732e92d6638b09039e9e7996b76140dc90b4a859cd235848d15a088bf66b554
- SHA512
  
  48c89076a84a16151195e0782e0f4721366407387b286ad07733db52f44f6ba2e567669fe3d850a550f5eaba98de7a3aa4450d16b715e4cde05d0837db9fd172
- SSDEEP
  
  384:rHPrJTpo7PC5xZ1bfsXsjlc46z/WnIM/0LfAmAnNfEbrpKz4M:rHP1Z5uXsZE5MijA
Score

10^/10

guloader lokibot collection credential_access discovery downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderlokibotcollectioncredential_accessdiscoverydownloaderspywarestealertrojan

behavioral2

guloaderlokibotcollectioncredential_accessdiscoverydownloaderspywarestealertrojan