guloader | be684c0623c1f226849c386f594c2626c14c73470a989a8907a03c258e01abfc

General

Target

be684c0623c1f226849c386f594c2626c14c73470a989a8907a03c258e01abfc
Size

64KB
Sample

220701-el8dnsdaf3
MD5

b2a52460d7ddcf0d1eb6cb98171309da
SHA1

fe2ae9c1d227e045351d4c8e64089cade6ca2f48
SHA256

be684c0623c1f226849c386f594c2626c14c73470a989a8907a03c258e01abfc
SHA512

d332b3cefa05f13338ebfdf5d2f87de593d82371ad950d815a8b5e4c41f06fb8a8722ab9da77286c7d6da82effc2faa4b7de246943f86f39e91ce3c926deb8cd

Score

10^/10

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1YqiJ4rfI-Gtvq2s00N_eqstSWsnL_fgd

Extracted

Family

webmonitor

C2

olaviqs.wm01.to:443

Attributes

config_key
7GfpikpHRvmQe3t81PSe02B3qwlPiFPx
private_key
JklcEIRIO
url_path
/recv5.php

Targets

- Target
  
  be684c0623c1f226849c386f594c2626c14c73470a989a8907a03c258e01abfc
- Size
  
  64KB
- MD5
  
  b2a52460d7ddcf0d1eb6cb98171309da
- SHA1
  
  fe2ae9c1d227e045351d4c8e64089cade6ca2f48
- SHA256
  
  be684c0623c1f226849c386f594c2626c14c73470a989a8907a03c258e01abfc
- SHA512
  
  d332b3cefa05f13338ebfdf5d2f87de593d82371ad950d815a8b5e4c41f06fb8a8722ab9da77286c7d6da82effc2faa4b7de246943f86f39e91ce3c926deb8cd
Score

10^/10

guloader webmonitor backdoor downloader infostealer rat upx persistence suricata
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- RevcodeRat, WebMonitorRat
  WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
  backdoor rat infostealer webmonitor
- WebMonitor Payload
- suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
  suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
  suricata
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Guloader,Cloudeye

RevcodeRat, WebMonitorRat

WebMonitor Payload

suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

UPX packed file

Unexpected DNS network traffic destination

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2