guloader | 8b496e6f6fa5824fc7a95dc9844fdcbbb3d8abb215476ffc2e2abe0142be0447 | Triage

Sharing

General

Target

Gymnasielrere84.vbs
Size

33KB
Sample

240922-rcnzwsshqc
MD5

0d5aa3c54f12fb3d254dc0ed6f946d2e
SHA1

04d6915391bc112a8dcc482616473d21e67209ac
SHA256

8b496e6f6fa5824fc7a95dc9844fdcbbb3d8abb215476ffc2e2abe0142be0447
SHA512

0e416cd7f37c8266269894ac768fc57172e55685555ed2db10ed74cba0f4d64b45d3582acd1a0717f47becd23450f5aec4038434366ccdb1a2cad2524c42e9d0
SSDEEP

384:Z9vOg3hVg1cC9a4pYTagc3NE7p5sUm5zSouEDfvl/7GRh/DvvxsWoutDwTK:Zp3hzC9aqYTEZUKXDfN/7GR1zxsODb

Score

10^/10

guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan

Malware Config

Targets

- Target
  
  Gymnasielrere84.vbs
- Size
  
  33KB
- MD5
  
  0d5aa3c54f12fb3d254dc0ed6f946d2e
- SHA1
  
  04d6915391bc112a8dcc482616473d21e67209ac
- SHA256
  
  8b496e6f6fa5824fc7a95dc9844fdcbbb3d8abb215476ffc2e2abe0142be0447
- SHA512
  
  0e416cd7f37c8266269894ac768fc57172e55685555ed2db10ed74cba0f4d64b45d3582acd1a0717f47becd23450f5aec4038434366ccdb1a2cad2524c42e9d0
- SSDEEP
  
  384:Z9vOg3hVg1cC9a4pYTagc3NE7p5sUm5zSouEDfvl/7GRh/DvvxsWoutDwTK:Zp3hzC9aqYTEZUKXDfN/7GR1zxsODb
Score

10^/10

guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderlokibotcollectioncredential_accessdiscoverydownloaderexecutionspywarestealertrojan

behavioral2

guloaderlokibotcollectioncredential_accessdiscoverydownloaderexecutionspywarestealertrojan