Extracted

• • Target

    LV24-0926.hta

  • Size

    7KB

  • MD5

    b604a446f056b778a22cf7ea6a6676ae

  • SHA1

    c198b474688cc106f9fc06cc6b9e569613f5e689

  • SHA256

    3023bc189f377a809d054529454fa9e35af817f3c9c3646c15d2d4da468676bf

  • SHA512

    4f54f91862b9fe8494cefbca8dae42cc930839206508fae41e0d3688b12a5e7bafa1eb0da6369daaa77af6db62cac02360b217a1a090a904b3a2720cdd6edd4e

  • SSDEEP

    192:hlN6ZVy2gAkJkhRg9e+UEmOVYpUVM2vy6n2MbIv:hqZVy2COhDNG1v9LIv

  Score

  10^/10

  guloaderlokibotcollectiondiscoverydownloaderspywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2