Overview

overview

10

Static

static

1

7d326abdb7...3c.vbs

windows7-x64

10

7d326abdb7...3c.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d326abdb7b5f1ecee1ab0385b9d4a569a1d355b479107aef9221fd213cfd23c.vbs

  • Size

    32KB

  • Sample

    240923-bpjypssdpl

  • MD5

    efc01dc5a4acefe058450f0dee1c1e9d

  • SHA1

    f6244111b8588a7105124c4f4c40f6caa2bffa28

  • SHA256

    7d326abdb7b5f1ecee1ab0385b9d4a569a1d355b479107aef9221fd213cfd23c

  • SHA512

    eab5f2a42206d42628ab77d566b7394e6dafbb785b5cfd3abc357c5eed4dfce501246246e67ffa0e4389c974ccf60dda598f64a3277925cca74fb0611505ea4d

  • SSDEEP

    384:Z9vOg3F19w8sNthahA0ZvF+io9vUErJHyvRe1P93fvTnm:Zp3F1qt0qA/oZJce1VHTm

Score
10/10
guloaderlokibotcollectioncredential_accessdiscoverydownloaderspywarestealertrojan

Malware Config

Targets

    • Target

      7d326abdb7b5f1ecee1ab0385b9d4a569a1d355b479107aef9221fd213cfd23c.vbs

    • Size

      32KB

    • MD5

      efc01dc5a4acefe058450f0dee1c1e9d

    • SHA1

      f6244111b8588a7105124c4f4c40f6caa2bffa28

    • SHA256

      7d326abdb7b5f1ecee1ab0385b9d4a569a1d355b479107aef9221fd213cfd23c

    • SHA512

      eab5f2a42206d42628ab77d566b7394e6dafbb785b5cfd3abc357c5eed4dfce501246246e67ffa0e4389c974ccf60dda598f64a3277925cca74fb0611505ea4d

    • SSDEEP

      384:Z9vOg3F19w8sNthahA0ZvF+io9vUErJHyvRe1P93fvTnm:Zp3F1qt0qA/oZJce1VHTm

    Score
    10/10
    guloaderlokibotcollectioncredential_accessdiscoverydownloaderspywarestealertrojan

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks