Overview

overview

10

Static

static

3c9004f9be...35.exe

windows7-x64

10

3c9004f9be...35.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c9004f9be1c84d28820577c1d892bdbf266e1dbff2aa09b1656bd853caf6835

  • Size

    96KB

  • Sample

    221125-kbzlnsha81

  • MD5

    9d869dc52423cc7fd932592c39faa32a

  • SHA1

    cf438cfda84a31bea0e80b807b80bfe1a8749cae

  • SHA256

    3c9004f9be1c84d28820577c1d892bdbf266e1dbff2aa09b1656bd853caf6835

  • SHA512

    1a1bee6086edff9cd76d0cc8f32d377b9dba2733b47cee408baff1c5b7ad5bdce2d777a487d51854ed010deba1a7e95cde8bd73895eee41f0cf3c6987a88c9c8

  • SSDEEP

    768:dg/v9AZqE+Caqi6UfBNhaQId1HyddYzctsCjuZHfMlig:u/AD/Xi6UfBNmVyd4cts1sR

Score
10/10
guloaderdownloaderguloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://bngsmartshop.com/sky_encrypted_408F3F0.bin

xor.base64

Targets

    • Target

      3c9004f9be1c84d28820577c1d892bdbf266e1dbff2aa09b1656bd853caf6835

    • Size

      96KB

    • MD5

      9d869dc52423cc7fd932592c39faa32a

    • SHA1

      cf438cfda84a31bea0e80b807b80bfe1a8749cae

    • SHA256

      3c9004f9be1c84d28820577c1d892bdbf266e1dbff2aa09b1656bd853caf6835

    • SHA512

      1a1bee6086edff9cd76d0cc8f32d377b9dba2733b47cee408baff1c5b7ad5bdce2d777a487d51854ed010deba1a7e95cde8bd73895eee41f0cf3c6987a88c9c8

    • SSDEEP

      768:dg/v9AZqE+Caqi6UfBNhaQId1HyddYzctsCjuZHfMlig:u/AD/Xi6UfBNmVyd4cts1sR

    Score
    10/10
    guloaderdownloaderguloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader payload

      guloader

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks