guloader | hxxps://onedrive[.]live[.]com/download?cid=35E4B6018A3C9CAA&resid=35E4B6018A3C9CAA%21117&authkey=AOhKv3CraS4e_eM

General

Target

https://onedrive.live.com/download?cid=35E4B6018A3C9CAA&resid=35E4B6018A3C9CAA%21117&authkey=AOhKv3CraS4e_eM
Sample

220317-3s9gbafdf9

Score

10^/10

Malware Config

Targets

- Target
  
  https://onedrive.live.com/download?cid=35E4B6018A3C9CAA&resid=35E4B6018A3C9CAA%21117&authkey=AOhKv3CraS4e_eM
Score

10^/10

guloader plugx downloader spyware stealer trojan
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- PlugX Rat Payload
- GuloaderShellcode
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

PlugX

PlugX Rat Payload

GuloaderShellcode

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v6

Tasks

static1

urlscan1

behavioral1

behavioral2