Overview

overview

10

Static

static

3

c8ef778ff1...95.exe

windows7-x64

10

c8ef778ff1...95.exe

windows10-2004-x64

8

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ge.dll

windows7-x64

1

$PLUGINSDI...ge.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195.exe

  • Size

    457KB

  • Sample

    240704-sdwa2azgme

  • MD5

    92a71af74ad52bd6968c86a1197df7d5

  • SHA1

    da3afefc08de0fa9b4b6c2742c927d6703fdae0c

  • SHA256

    c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195

  • SHA512

    706482562653c189027a0d53d34ea8fc8ebf85528c96c05b4651f0a08665db94666edd078f799bbc5e2753428e2f9fe3dddd223150e856e23d34fdd0e3fe88fd

  • SSDEEP

    6144:coShfU3osnd2J4v8KJIRySSDbnybCiRG26b5hiVLaf3Uz9YP3WImQK+9OIT8CCvP:Fqgowd2JY8NRPE7yvRAQVLafPP3jfLkP

Score
10/10
guloaderlokibotcollectiondownloaderexecutionspywarestealertrojan

Malware Config

Targets

    • Target

      c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195.exe

    • Size

      457KB

    • MD5

      92a71af74ad52bd6968c86a1197df7d5

    • SHA1

      da3afefc08de0fa9b4b6c2742c927d6703fdae0c

    • SHA256

      c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195

    • SHA512

      706482562653c189027a0d53d34ea8fc8ebf85528c96c05b4651f0a08665db94666edd078f799bbc5e2753428e2f9fe3dddd223150e856e23d34fdd0e3fe88fd

    • SSDEEP

      6144:coShfU3osnd2J4v8KJIRySSDbnybCiRG26b5hiVLaf3Uz9YP3WImQK+9OIT8CCvP:Fqgowd2JY8NRPE7yvRAQVLafPP3jfLkP

    Score
    10/10
    guloaderlokibotcollectiondownloaderexecutionspywarestealertrojan

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Banner.dll

    • Size

      4KB

    • MD5

      843657eaf7240b695624dcf38bb0eb31

    • SHA1

      ca99a44e737fdeaab56f864ce1ef15a57d2eec90

    • SHA256

      b935d14c32ad8e16055f7f5794ac3411e601c5ac93155afc623f25b08e2ab82e

    • SHA512

      7773d9f6bbd17253d1c96ce225b2f9d3673969b38177afef236d1c5d4aabaae2c07793e07c34f0281ec3b859ae955e83bfe43a598ce7cc6c893ec8c9604f5de3

    Score
    1/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/BgImage.dll

    • Size

      7KB

    • MD5

      a98576f0d6b35b466cb881860977fdbc

    • SHA1

      28b3dbbd76f15c876b98dce523100aa3256d193a

    • SHA256

      6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2

    • SHA512

      29225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c

    • SSDEEP

      96:8e70AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk7nLiEQjJ3KxkP:tBBfjbUA/85q3wEh8uLmqLpmP

    Score
    1/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      2c84faebfda2abe3b16fdf374df4272f

    • SHA1

      a5b0258a94e0440aefe1ef320e62e7a9a1c8bb40

    • SHA256

      72b38e4cca0af336655d55501c4ea05080baaa9921a62a2d717afe90bb801004

    • SHA512

      207164cc6914c59d9f4f3b8ae97628c544093ba6ecda9f8da351f453cd97e03be7a640264b8686b2d5e6f3c787f4df1d8a1ebc8e51fd788a97460cd981cc015e

    • SSDEEP

      96:3ip41CMj95rKhkfL5RkEdKkcxM2DjDf3GE/E9v5E9av+Yx4QndY7ndS27gA:3iujesS4HRE/K5MYxBdqn420

    Score
    3/10
    behavioral7behavioral8

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks