Overview

overview

10

Static

static

bb9e4697a8...24.exe

windows7_x64

10

bb9e4697a8...24.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824

  • Size

    124KB

  • Sample

    220201-etx8nshba8

  • MD5

    1a53e9230ba3bbd5969cc4499baaacdd

  • SHA1

    2a55286c66012cfb09151effabac6f8d54cc3ce1

  • SHA256

    bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824

  • SHA512

    3dd984ec282e2bd4ce4e26aa2c84548b69ef695ef761498eb40a4484a9f5be08bca851ca3d868b8b353721b65fd3252a42ebe0ad5cfc70d0591b97b580752f3d

Score
10/10
guloaderdownloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1usXhLD59IUljCZdD222jP2QYU-GP28tz

http://bnvtfhdfsasd.ug/Host_encrypted_F8B4CEF.bin
xor.base64

Targets

    • Target

      bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824

    • Size

      124KB

    • MD5

      1a53e9230ba3bbd5969cc4499baaacdd

    • SHA1

      2a55286c66012cfb09151effabac6f8d54cc3ce1

    • SHA256

      bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824

    • SHA512

      3dd984ec282e2bd4ce4e26aa2c84548b69ef695ef761498eb40a4484a9f5be08bca851ca3d868b8b353721b65fd3252a42ebe0ad5cfc70d0591b97b580752f3d

    Score
    10/10
    guloaderdownloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks