Overview

overview

10

Static

static

c87290bb28...3b.exe

windows7_x64

10

c87290bb28...3b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c87290bb28696eddacaadc0f01805f841bda964d55efa9c39d0a06f1d31ede3b

  • Size

    84KB

  • Sample

    220131-18hmesdcd9

  • MD5

    6f771a54cdb6f1cc2130310bc40f215f

  • SHA1

    f860c1449917fb1e5418a4862bbb28b79ec29787

  • SHA256

    c87290bb28696eddacaadc0f01805f841bda964d55efa9c39d0a06f1d31ede3b

  • SHA512

    d49d0db7bc6fa784e517d5d457b4516faa2d2bc36e336827c1a10c251daeb725a9bc1edc815d58febb0bb3068bf68086700dbfd0376aeb9b08041214cc15eb0f

Score
10/10
guloaderdownloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://onedrive.live.com/download?cid=4C3F5C65A99DA195&resid=4C3F5C65A99DA195%21250&authkey=AC-XqzwfVaSlHmQ

xor.base64

Targets

    • Target

      c87290bb28696eddacaadc0f01805f841bda964d55efa9c39d0a06f1d31ede3b

    • Size

      84KB

    • MD5

      6f771a54cdb6f1cc2130310bc40f215f

    • SHA1

      f860c1449917fb1e5418a4862bbb28b79ec29787

    • SHA256

      c87290bb28696eddacaadc0f01805f841bda964d55efa9c39d0a06f1d31ede3b

    • SHA512

      d49d0db7bc6fa784e517d5d457b4516faa2d2bc36e336827c1a10c251daeb725a9bc1edc815d58febb0bb3068bf68086700dbfd0376aeb9b08041214cc15eb0f

    Score
    10/10
    guloaderdownloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Sets service image path in registry

      persistence

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks