Overview

overview

10

Static

static

6292564d78...b7.exe

windows7_x64

10

6292564d78...b7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7

  • Size

    56KB

  • Sample

    220625-jdhkhabchj

  • MD5

    c240069b9ddb2fd496f2407101125fae

  • SHA1

    a664a87f951ffba1d3842967e1fac9c603130777

  • SHA256

    6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7

  • SHA512

    01ffa9979672bd7ea87270b08c0bef3410a5896f59a1be5168c8a47285480b7ee014e9d6bb1bed2a6f8e20c12571aba2dd8b329377214bf4f93d69d8d90b5fe6

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1lKLbw-xDVj_b7ejiygi2KBe2Iq6x1Lf2

xor.base64

Targets

    • Target

      6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7

    • Size

      56KB

    • MD5

      c240069b9ddb2fd496f2407101125fae

    • SHA1

      a664a87f951ffba1d3842967e1fac9c603130777

    • SHA256

      6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7

    • SHA512

      01ffa9979672bd7ea87270b08c0bef3410a5896f59a1be5168c8a47285480b7ee014e9d6bb1bed2a6f8e20c12571aba2dd8b329377214bf4f93d69d8d90b5fe6

    Score
    10/10
    guloaderdownloaderguloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader Payload

      guloader

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks