General
- Target 7614449f12890951020a0280e1eca1a6719a9fcc2162288bf734ffd6a15686f9.vbe
- Size 30KB
- Sample240926-mpf3lasenn
- SHA256 7614449f12890951020a0280e1eca1a6719a9fcc2162288bf734ffd6a15686f9
Score
10/10
Malware Config
Targets
-
- Target 7614449f12890951020a0280e1eca1a6719a9fcc2162288bf734ffd6a15686f9.vbe
- Size 30KB
- SHA256 7614449f12890951020a0280e1eca1a6719a9fcc2162288bf734ffd6a15686f9
Score10/10Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
Blocklisted process makes network request
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext