General
-
Target
Solicitud De Presupuesto 09-16-2024·pdf.vbs
-
Size
33KB
-
Sample
240917-rc9xcsxbml
-
MD5
cd0669221e6722bb84542cc73f29a482
-
SHA1
3fdaefe57d23b8091b944a31604ad19e147a8ddf
-
SHA256
d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74
-
SHA512
48f1f862758fc879b5eb22d601fd1fe57af006c3b12779b86d6370b17c671375a019683abc99a60651ef44b633bb33d68f993f81026bf0df34b55d347d06f5ec
-
SSDEEP
384:Z9vOg3vacyZnIr8hWY/NeNz7trA4qAGkespLV5SEGOiOUvT4drEhN4Q:Zp3vcWY/UzOkelSVrwD
Malware Config
Targets
-
-
Target
Solicitud De Presupuesto 09-16-2024·pdf.vbs
-
Size
33KB
-
MD5
cd0669221e6722bb84542cc73f29a482
-
SHA1
3fdaefe57d23b8091b944a31604ad19e147a8ddf
-
SHA256
d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74
-
SHA512
48f1f862758fc879b5eb22d601fd1fe57af006c3b12779b86d6370b17c671375a019683abc99a60651ef44b633bb33d68f993f81026bf0df34b55d347d06f5ec
-
SSDEEP
384:Z9vOg3vacyZnIr8hWY/NeNz7trA4qAGkespLV5SEGOiOUvT4drEhN4Q:Zp3vcWY/UzOkelSVrwD
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-