guloader | 983e0421cd309bd8732a52aa652720cfb796b11e61f3bf4ba0db1fe405b82a92

General

Target

983e0421cd309bd8732a52aa652720cfb796b11e61f3bf4ba0db1fe405b82a92.vbs
Size

41KB
Sample

240918-btzvqawbrj
MD5

a9e7ff05c4fa8bf06479b824d0340b42
SHA1

73f218ddf92c79fce8c09638501a7610ffa6d650
SHA256

983e0421cd309bd8732a52aa652720cfb796b11e61f3bf4ba0db1fe405b82a92
SHA512

f42991287e5b395549ea8f65cbcb7747607fdd1550433c494a10d291c9aa1960e6907db08ecc6a8dfacaf3aded63d654268c1e2fee21984c74a591256970e8cd
SSDEEP

384:Z9vOg30sUqXgcAT0179dzJTAtKdkWIinkc0MyXgve7r87qUF8S09:Zp30wgcAAZ/zQxf/rYG

Score

10^/10

Malware Config

Targets

- Target
  
  983e0421cd309bd8732a52aa652720cfb796b11e61f3bf4ba0db1fe405b82a92.vbs
- Size
  
  41KB
- MD5
  
  a9e7ff05c4fa8bf06479b824d0340b42
- SHA1
  
  73f218ddf92c79fce8c09638501a7610ffa6d650
- SHA256
  
  983e0421cd309bd8732a52aa652720cfb796b11e61f3bf4ba0db1fe405b82a92
- SHA512
  
  f42991287e5b395549ea8f65cbcb7747607fdd1550433c494a10d291c9aa1960e6907db08ecc6a8dfacaf3aded63d654268c1e2fee21984c74a591256970e8cd
- SSDEEP
  
  384:Z9vOg30sUqXgcAT0179dzJTAtKdkWIinkc0MyXgve7r87qUF8S09:Zp30wgcAAZ/zQxf/rYG
Score

10^/10

guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2