guloader | 03082b2f67073c9017a28fe1ef9166d38edd339ef72da583653f083ec2b9fac4 | Triage™

Analysis

max time kernel
108s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
27/09/2021, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payment confirmation.exe
Size 88KB
Sample210927-rjfbbshbf9
SHA256 03082b2f67073c9017a28fe1ef9166d38edd339ef72da583653f083ec2b9fac4
MD5 930debccdeecb4fc138b0319bef33720
SHA1 b56f93dc8316eb35a3b311ce1c412e5d617bcfeb
SHA512 bfd528e239d9dc5ed5c74b6443eb2f4eacf508e4254a7ece0f5d997f80103afea403510257c83a6820f4aa516ac87614887cb19f3b0082c5b0fd9c3ecab7daa7
MD5 SHA1 SHA512

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
656	payment confirmation.exe

C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-116-0x0000000002210000-0x0000000002221000-memory.dmp

Download