guloader | 1fbf984271ffa5cf79c2e5e9be8d40198d2c6619ce96899844a9d4ab2ef5bffa | Triage

Analysis

max time kernel
16s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
23-07-2021 16:36

Sharing

Report Analysis Logs

General

Target

8ff85d12eff7c5ab365a1feccd45513b.exe
Size

188KB
MD5

8ff85d12eff7c5ab365a1feccd45513b
SHA1

2c0cf4adfe283e55a8c409367f396a84101defa3
SHA256

1fbf984271ffa5cf79c2e5e9be8d40198d2c6619ce96899844a9d4ab2ef5bffa
SHA512

95d7a49e2ce948160fd1f43e8448ab2c5255cf06aff0b63f54847354286dba1fc767fa673912838448dc348d590f1c1d25441a84b00733db22bda8c45fb68eb6

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8ff85d12eff7c5ab365a1feccd45513b.exe

pid process

3128 8ff85d12eff7c5ab365a1feccd45513b.exe

C:\Users\Admin\AppData\Local\Temp\8ff85d12eff7c5ab365a1feccd45513b.exe
"C:\Users\Admin\AppData\Local\Temp\8ff85d12eff7c5ab365a1feccd45513b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3128

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3128-116-0x0000000002AE0000-0x0000000002B0A000-memory.dmp

Filesize
168KB

Download