Overview

overview

10

Static

static

SHIPPING DOCUMENT.scr

windows7_x64

10

SHIPPING DOCUMENT.scr

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d260d6cf07d74ca3e53b6bd294387894d6a4a0b7c76132359007cba026cef144

  • Size

    17KB

  • Sample

    220521-w8czqabbe2

  • MD5

    bd4d42e4b92ec5bad89ce9df7a46b860

  • SHA1

    d23fab700d9b6a71c5b920aa290b0c21aa2c3883

  • SHA256

    d260d6cf07d74ca3e53b6bd294387894d6a4a0b7c76132359007cba026cef144

  • SHA512

    169bd3260b7f6181b890e8be5a40054ee36a55728551c5abe1f07d7b1fa0ec8916fbe43b03d324586b8a3a7f1e3a59df1dc4005b543dd86a89ae8754a9be0a2a

Score
10/10
guloaderdownloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1_oth8C6SFfuRuHZpRwX3CHrHvH7H3Cwv

xor.base64

Targets

    • Target

      SHIPPING DOCUMENT.scr

    • Size

      84KB

    • MD5

      413d2dbeb92babc91dee4688dff52642

    • SHA1

      0efb2c7c544d774709504c94bb4cdc469ff8e367

    • SHA256

      08954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8

    • SHA512

      9a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59

    Score
    10/10
    guloaderdownloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Executes dropped EXE

    • Checks QEMU agent state file

      Checks state file used by QEMU agent, possibly to detect virtualization.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks