guloader | c656ce8f06068e50597a6ccb1835f2f32062ba79398822a8c799f3314fdc280f | Triage

Sharing

General

Target

JUSTIFICANTE+DE+PAGO+00234311.rar
Size

260KB
Sample

221013-t23wfsdde7
MD5

ecc602066a19065b44d2b22259df4247
SHA1

80aad72d8103a2d56a8fd9b392ef7f058d39b687
SHA256

c656ce8f06068e50597a6ccb1835f2f32062ba79398822a8c799f3314fdc280f
SHA512

07fd2c00ad8d83ebfc376d809852f4cdd0bc4f3a9c02eabc41c9bf941f40a9792c3c5469ca5741e4d2ea1c0073ae0eab960fc63a4c746e3863ddbbceabbcdc48
SSDEEP

6144:uqAhPYkTdsQPT4KfURhn85Stt9czLWLQtE:yhDKIgnySZXsu

Score

10^/10

guloader discovery downloader

Malware Config

Targets

- Target
  
  JUSTIFICANTE DE PAGO 00234311.exe
- Size
  
  315KB
- MD5
  
  398ca1bf262cff416cc76db6165c7cfe
- SHA1
  
  bffea13ecc2e160bc6beea8d38f99de0167c9cc6
- SHA256
  
  47ebb2eba1d4e6ca66edfd9a5721b55b89d2a58707217c80b7fa24cec21be53a
- SHA512
  
  ea395bb3c67590cdb1df985f384d0f5087fc2db451c758227236b585413a93a82eb6dfab06cab3789981a138dcdd1f32d60d9e48f7ab696a087a71fd9a9ec991
- SSDEEP
  
  6144:yB+pqUQLU87hsR0qW6IqiQ928gJzoQRT0uAg67ONVxTJ0hvTXeCOKxaO/TId7Ucj:ygKL2i0uAxGv0jRZPId7Ui
Score

10^/10

guloader discovery downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderdiscoverydownloader

behavioral2

guloaderdiscoverydownloader