guloader | 4a3d3d894a64525be3d2b85e4189155e1aacfaa69d4d90be20a63106341055db | Triage

Sharing

General

Target

4a3d3d894a64525be3d2b85e4189155e1aacfaa69d4d90be20a63106341055db
Size

9KB
Sample

240909-nj3j3svfkl
MD5

d0ee99048ac2eb96acc75d2252eb50f8
SHA1

8f8ced00885b8ee663d5369a2135a1ec922480fb
SHA256

4a3d3d894a64525be3d2b85e4189155e1aacfaa69d4d90be20a63106341055db
SHA512

312b9999a31a5000bbed1ca8db26a16e7e6cd79cf322f11002910cce340a61563883f83aac1c819e5f5d8d495de24062273fbcf436746a6b48ca09fce5efd1f5
SSDEEP

192:1Qf5otiTpifuk/xPge76X9dGtjomfMp2M5dae3VHPVViKtiijD:KyMlzk/xV76XCkGMT5dae3ZVcK1D

Score

10^/10

guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan

Malware Config

Targets

- Target
  
  BID REQUEST 09-09-2024·pdf.vbs
- Size
  
  28KB
- MD5
  
  91f307a573cd6e7ee7e8c741cde8a157
- SHA1
  
  d3b75565ad3e04be34cc66b6571614d440429cde
- SHA256
  
  dcc61fc2e0953c7200312ebee92f58407686435980d53001cd2b86ee2e7eda25
- SHA512
  
  6353409bc55e4ab387395acd0909be30c8b3dd271a8f4b52bcebc7e60562b46f5d076dcac2b42aca9c77c212ea384cf1d015ce8f104cb77f5128314a52bf6607
- SSDEEP
  
  192:3fC9kiwVtrdKy5L4vGK7cxIZfTEtlUJKQbo7jdfBr2wojG87ves+d7vS9TMW:3fGordf0oX9QakfG8rPumMW
Score

10^/10

guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderlokibotcollectioncredential_accessdiscoverydownloaderexecutionspywarestealertrojan

behavioral2

guloaderlokibotcollectioncredential_accessdiscoverydownloaderexecutionspywarestealertrojan