Overview

overview

10

Static

static

10

PO_#20202502.scr

windows7_x64

10

PO_#20202502.scr

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c54d46be1dd0d687d50db2940777c0cbcf31db55b7b8daec8a6921cb21661483

  • Size

    19KB

  • Sample

    220703-wbq53sagbq

  • MD5

    7aab25d95013f536dd93a76029d22c72

  • SHA1

    d57c3464e52ac5394429ca97deea84d76228b649

  • SHA256

    c54d46be1dd0d687d50db2940777c0cbcf31db55b7b8daec8a6921cb21661483

  • SHA512

    c58efac398367b8798b65d41f3049712955771d3d4d363c83ee12b783f1e4a63036f318aa45a361c8498722e339aa61be09b49ee4ccc0c27aa941c6f40411a79

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1wVyC3O3_fEGjFDFp7iYa9vn_Wj-PUf7T

xor.base64

Targets

    • Target

      PO_#20202502.scr

    • Size

      52KB

    • MD5

      aa98858ca9f1521c29db264c52271758

    • SHA1

      4ef7073f733fe78aa058f9a8cd8c460790b1c14f

    • SHA256

      589839605568c90ecea1bcf14ce7a1076695fc5acf3e9111fb84702bb19af07f

    • SHA512

      11b69c30a50112431c54ebbfda933cf61d54b1941f47e59af3cfc5d40727a6f0f499eb0111d9542e7922f8e910613530a95abc29ca1ab11bbe146efea2918813

    Score
    10/10
    guloaderdownloaderguloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader Payload

      guloader

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks