Extracted

Extracted

• • Target
    b31fdfb032644bcb1f8b072f4dc5e11a.exe
  • Size 197KB
  • SHA256 4ef528f41c74b287a3bc8bcb4cf1cde16d54b0fbdffe11e845e5aa2b656dc961
  • MD5 b31fdfb032644bcb1f8b072f4dc5e11a
  • SHA1 1f4213eeaf0990d62b6c46ea8f29026c1555bc1a
  • SHA512 653a701f4ed1cecd6081e800ec50300a11ac1b927b32192deef796176e655f287bf5024279f0e2821ab5ee62cbc6ac24155b12a9be637dd1c199209289f05087
  • MD5 SHA1 SHA512

  Score

  10^/10

  guloaderlokibotponycollectiondiscoverydownloaderratspywarestealertrojanpersistence

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets service image path in registry

    persistence

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2