Overview

overview

10

Static

static

d8eb1f8dd3...87.exe

windows7_x64

10

d8eb1f8dd3...87.exe

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487

  • Size

    92KB

  • Sample

    220131-17n3tadcc9

  • MD5

    232da2765bbf79ea4a51726285cb65d1

  • SHA1

    8bd91761024047cd3360716cc68ebdcf604a1854

  • SHA256

    d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487

  • SHA512

    7deacbcae42ab0c42e02af455091a254ab37beb5396be8db40a070ffb343c9f400906838d33e597196cbe22626d5789beac83cf0db39832cd4c6a7b407697002

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://cdn-12.anonfile.com/RdO1lcdaod/77814bdf-1582785178/makave@popeorigin6_encrypted_4407DD0.bin

https://cdn.filesend.jp/private/hcmyj5nD6aJkDXptSilmcc1iHGLaXs0QTpyQDASA5AqNsWXFkzdNappNJ0_8-TEx/makave%40popeorigin6_encrypted_4407DD0.bin
xor.base64

Targets

    • Target

      d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487

    • Size

      92KB

    • MD5

      232da2765bbf79ea4a51726285cb65d1

    • SHA1

      8bd91761024047cd3360716cc68ebdcf604a1854

    • SHA256

      d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487

    • SHA512

      7deacbcae42ab0c42e02af455091a254ab37beb5396be8db40a070ffb343c9f400906838d33e597196cbe22626d5789beac83cf0db39832cd4c6a7b407697002

    Score
    10/10
    guloaderdownloaderguloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader Payload

      guloader

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks