Overview

overview

10

Static

static

fd6e6be3f9...34.exe

windows7-x64

10

fd6e6be3f9...34.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd6e6be3f9dd51b452068d326d464dffa64e0669773e7d24d90e93407a627b34

  • Size

    60KB

  • Sample

    220724-vjnjgsbhbl

  • MD5

    0fb79c89f1013b87699385a4deb5bafa

  • SHA1

    0c6e93dadad8c9750f8301184116c68d6ad675dc

  • SHA256

    fd6e6be3f9dd51b452068d326d464dffa64e0669773e7d24d90e93407a627b34

  • SHA512

    7cb5d4b5ded1c7fd5a7304f16f8f3c9c1d145c4b336692da5e4a67621ccce49e9f1d83e488204936baae7fa15c1b6d70568b7ee7a77e10eb9964bfd75b7cb816

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1s6Jk7utxfKJOqqXxtrZJtXj2BPIgDzPT

xor.base64

Targets

    • Target

      fd6e6be3f9dd51b452068d326d464dffa64e0669773e7d24d90e93407a627b34

    • Size

      60KB

    • MD5

      0fb79c89f1013b87699385a4deb5bafa

    • SHA1

      0c6e93dadad8c9750f8301184116c68d6ad675dc

    • SHA256

      fd6e6be3f9dd51b452068d326d464dffa64e0669773e7d24d90e93407a627b34

    • SHA512

      7cb5d4b5ded1c7fd5a7304f16f8f3c9c1d145c4b336692da5e4a67621ccce49e9f1d83e488204936baae7fa15c1b6d70568b7ee7a77e10eb9964bfd75b7cb816

    Score
    10/10
    guloaderdownloaderguloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader payload

      guloader

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks