guloader | 2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152

General

Target

2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152_NeikiAnalytics.exe
Size

492KB
Sample

240626-ar3m6awaqq
MD5

daefc1d031c8aaa70bc98e08278792c0
SHA1

148d0b47ec294971d0a7bc64b93e21c15048ad75
SHA256

2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152
SHA512

e9831ed53ef93d401fcf870dfe943e9ce76bf01deedba4db46d8860b638432445b6e7b13c639b2dd6dc8df7d1b82c57f1325aeba27816cd6d6d108dea351293c
SSDEEP

12288:Tqgow1LlsfJfmAhRRwXyx+B7JgyD9qhIVa5LkS:N1L+fJeAhRiix+lJgyZXVa5R

Score

10^/10

Malware Config

Targets

- Target
  
  2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152_NeikiAnalytics.exe
- Size
  
  492KB
- MD5
  
  daefc1d031c8aaa70bc98e08278792c0
- SHA1
  
  148d0b47ec294971d0a7bc64b93e21c15048ad75
- SHA256
  
  2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152
- SHA512
  
  e9831ed53ef93d401fcf870dfe943e9ce76bf01deedba4db46d8860b638432445b6e7b13c639b2dd6dc8df7d1b82c57f1325aeba27816cd6d6d108dea351293c
- SSDEEP
  
  12288:Tqgow1LlsfJfmAhRRwXyx+B7JgyD9qhIVa5LkS:N1L+fJeAhRiix+lJgyZXVa5R
Score

10^/10

guloader lokibot collection downloader execution persistence spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/Banner.dll
- Size
  
  4KB
- MD5
  
  843657eaf7240b695624dcf38bb0eb31
- SHA1
  
  ca99a44e737fdeaab56f864ce1ef15a57d2eec90
- SHA256
  
  b935d14c32ad8e16055f7f5794ac3411e601c5ac93155afc623f25b08e2ab82e
- SHA512
  
  7773d9f6bbd17253d1c96ce225b2f9d3673969b38177afef236d1c5d4aabaae2c07793e07c34f0281ec3b859ae955e83bfe43a598ce7cc6c893ec8c9604f5de3
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/BgImage.dll
- Size
  
  7KB
- MD5
  
  a98576f0d6b35b466cb881860977fdbc
- SHA1
  
  28b3dbbd76f15c876b98dce523100aa3256d193a
- SHA256
  
  6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
- SHA512
  
  29225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c
- SSDEEP
  
  96:8e70AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk7nLiEQjJ3KxkP:tBBfjbUA/85q3wEh8uLmqLpmP
Score

1^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  2c84faebfda2abe3b16fdf374df4272f
- SHA1
  
  a5b0258a94e0440aefe1ef320e62e7a9a1c8bb40
- SHA256
  
  72b38e4cca0af336655d55501c4ea05080baaa9921a62a2d717afe90bb801004
- SHA512
  
  207164cc6914c59d9f4f3b8ae97628c544093ba6ecda9f8da351f453cd97e03be7a640264b8686b2d5e6f3c787f4df1d8a1ebc8e51fd788a97460cd981cc015e
- SSDEEP
  
  96:3ip41CMj95rKhkfL5RkEdKkcxM2DjDf3GE/E9v5E9av+Yx4QndY7ndS27gA:3iujesS4HRE/K5MYxBdqn420
Score

3^/10
behavioral7 behavioral8

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Lokibot

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Accesses Microsoft Outlook profiles

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8