Overview

overview

10

Static

static

OOCS DI- 2...CB.exe

windows7_x64

10

OOCS DI- 2...CB.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e6acc2cd69014ea5f71b50328997193ed91eae000033ccffd7b6e6a8b17291b

  • Size

    148KB

  • Sample

    220701-scrw8ahbfq

  • MD5

    08202accb0f84a3a5235b1a7413dd1dc

  • SHA1

    a6d499156b41ff86442401682e1947e3cf68f3f3

  • SHA256

    5e6acc2cd69014ea5f71b50328997193ed91eae000033ccffd7b6e6a8b17291b

  • SHA512

    bd1c070b4a98b5391f6905799d6120a41694edeab4910f9e51d19539c1237fcfefae45321b05113b3959339db388e71dc35fe10da8a74e48eb1f6a364af5a15d

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1O2SgmqVx05-yOgWHa8SgLEVXME50y2P0

xor.base64

Targets

    • Target

      OOCS DI- 209871 CB.exe

    • Size

      88KB

    • MD5

      9a38cec7850d8cd79fc0bf440e5297e0

    • SHA1

      4d8d8365d192135608990a0998973973d52624a0

    • SHA256

      1f970a14fb1efcbcdca7c274d76c4eabd3699e62015a58226d6e328b83d4f0fe

    • SHA512

      f5ef4c2f8e8d13a9829a0665bec7cc087a560e804209f0675e47f39082c12524785412c026bf98aaa98e20b65dcfe60785d74bbd199df83b9d6d15dca941afec

    Score
    10/10
    guloaderdownloaderguloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader Payload

      guloader

    • Checks QEMU agent state file

      Checks state file used by QEMU agent, possibly to detect virtualization.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks