Overview

overview

10

Static

static

gunzipped.exe

windows7_x64

10

gunzipped.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gunzipped

  • Size

    212KB

  • Sample

    210421-f222slvb1s

  • MD5

    e8caac54776eac6e3740c9c8426486df

  • SHA1

    d6720055a125da5922be71b69b3a4078a49642ea

  • SHA256

    d75c69a49a30595964989b72499ec0e303ff42a0e2a334dda22a9cd9fd7e8ba5

  • SHA512

    0e16cb730971d507c9767b953c2d320b9b5a8099b736bcb42e92435d13cf77083ad2a98bf23a42af53c36907c29949f30f4e1e548662a76adb877487549f5bea

Score
10/10
guloaderdownloaderguloader

Malware Config

Targets

    • Target

      gunzipped

    • Size

      212KB

    • MD5

      e8caac54776eac6e3740c9c8426486df

    • SHA1

      d6720055a125da5922be71b69b3a4078a49642ea

    • SHA256

      d75c69a49a30595964989b72499ec0e303ff42a0e2a334dda22a9cd9fd7e8ba5

    • SHA512

      0e16cb730971d507c9767b953c2d320b9b5a8099b736bcb42e92435d13cf77083ad2a98bf23a42af53c36907c29949f30f4e1e548662a76adb877487549f5bea

    Score
    10/10
    guloaderdownloaderguloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader Payload

      guloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks