guloader | 8775466739105b4c7bf67886f0f7f412ca3ff6272c1f72dda0c8c19da16e684d

General

Target

Maersk_Shipping_Cargo_Arrival_notice#83736494.exe
Size

600KB
Sample

220711-kl2tsahhb8
MD5

eca01282aa1848837b90e4a500040888
SHA1

d73c8b229a3951b255a25e8dc75b251da92c22d7
SHA256

8775466739105b4c7bf67886f0f7f412ca3ff6272c1f72dda0c8c19da16e684d
SHA512

88e41214aa8e995f4706f9340083eb80dcdaef14856e70bad3f5db634a530e1f97ffbe7d17ab905d572631d72582b46603e2b594a661cc42d003e881e5e19b22

Score

10^/10

Malware Config

Targets

- Target
  
  Maersk_Shipping_Cargo_Arrival_notice#83736494.exe
- Size
  
  600KB
- MD5
  
  eca01282aa1848837b90e4a500040888
- SHA1
  
  d73c8b229a3951b255a25e8dc75b251da92c22d7
- SHA256
  
  8775466739105b4c7bf67886f0f7f412ca3ff6272c1f72dda0c8c19da16e684d
- SHA512
  
  88e41214aa8e995f4706f9340083eb80dcdaef14856e70bad3f5db634a530e1f97ffbe7d17ab905d572631d72582b46603e2b594a661cc42d003e881e5e19b22
Score

10^/10

guloader neshta discovery downloader persistence spyware stealer
- Detect Neshta payload
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2