Overview

overview

10

Static

static

cbffd8f471...5b.exe

windows7_x64

10

cbffd8f471...5b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cbffd8f471de9728610b1edd4519f65399a8e64e46177e1178685ef6b081065b

  • Size

    132KB

  • Sample

    220131-18a8cadcd8

  • MD5

    8cc439ec874e83f11433d4c6ca244d6a

  • SHA1

    1c325c12e0d63e03bab431da04b7f253c65eec3d

  • SHA256

    cbffd8f471de9728610b1edd4519f65399a8e64e46177e1178685ef6b081065b

  • SHA512

    06f527448714c4e6c5344446a4f5fe59d83fde200e59cb22a8ffeac3fa57f1fbddf383a0663f9d56a755f71102a54cf44a4143d8a2a4b13b7285dc9d76dc76c1

Score
10/10
guloaderdownloaderguloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1EQ7DIlAk9lk2E52DQLELmB02ADqw-62s

xor.base64

Targets

    • Target

      cbffd8f471de9728610b1edd4519f65399a8e64e46177e1178685ef6b081065b

    • Size

      132KB

    • MD5

      8cc439ec874e83f11433d4c6ca244d6a

    • SHA1

      1c325c12e0d63e03bab431da04b7f253c65eec3d

    • SHA256

      cbffd8f471de9728610b1edd4519f65399a8e64e46177e1178685ef6b081065b

    • SHA512

      06f527448714c4e6c5344446a4f5fe59d83fde200e59cb22a8ffeac3fa57f1fbddf383a0663f9d56a755f71102a54cf44a4143d8a2a4b13b7285dc9d76dc76c1

    Score
    10/10
    guloaderdownloaderguloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader Payload

      guloader

    • Sets service image path in registry

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks