Overview

overview

10

Static

static

3

malware.exe

windows7-x64

10

malware.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    malware.exe

  • Size

    467KB

  • Sample

    240626-j9y75axgmp

  • MD5

    4015f00ef3731b6caa8862aacc178f2e

  • SHA1

    a95f1a8fef002703f6c303121c36269485cccc50

  • SHA256

    ad2b8c6d46879d5c83c2a89020cf39f29f7344532b26e1ea8c91cbeb7fb3440c

  • SHA512

    3f55db58dadcb4b5d46da5a515d0f37ebb6ef328f6fdd1bbcd54b922dd1ba19c110dc951cbb91a4c529a4c79f48cdcc26a40c6475de634ee42356bc1b33cbd75

  • SSDEEP

    6144:nNoShfU3osnA2UnjCD5JnYR/Z13P4FgsLJNFRzEBsT8CCv74:naqgowbYCDUR/TP4VVNEBsLks

Score
10/10
guloaderlokibotcollectiondownloaderexecutionspywarestealertrojan

Malware Config

Targets

    • Target

      malware.exe

    • Size

      467KB

    • MD5

      4015f00ef3731b6caa8862aacc178f2e

    • SHA1

      a95f1a8fef002703f6c303121c36269485cccc50

    • SHA256

      ad2b8c6d46879d5c83c2a89020cf39f29f7344532b26e1ea8c91cbeb7fb3440c

    • SHA512

      3f55db58dadcb4b5d46da5a515d0f37ebb6ef328f6fdd1bbcd54b922dd1ba19c110dc951cbb91a4c529a4c79f48cdcc26a40c6475de634ee42356bc1b33cbd75

    • SSDEEP

      6144:nNoShfU3osnA2UnjCD5JnYR/Z13P4FgsLJNFRzEBsT8CCv74:naqgowbYCDUR/TP4VVNEBsLks

    Score
    10/10
    guloaderlokibotcollectiondownloaderexecutionspywarestealertrojan

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks