Overview

overview

10

Static

static

46ca6b60ad...0b.exe

windows7-x64

10

46ca6b60ad...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    46ca6b60ad6492b4548cb25c5e7ff6981bf7f0a7961743222dc3f25d1f12280b

  • Size

    60KB

  • Sample

    221125-krbjsaaa4v

  • MD5

    daaff39b3854fe5ef5427eec52265fd8

  • SHA1

    4ad3c1cbfc9a19a245195e5044d53a2d26e447f7

  • SHA256

    46ca6b60ad6492b4548cb25c5e7ff6981bf7f0a7961743222dc3f25d1f12280b

  • SHA512

    aa24e27ea4b92dc55abb6f071f03e8f1b99125ee71716d6e66bc969e0d680d5d9d6147946a2a58a72860f4bc8ee630a4ed9c60c676aad610bd00e177c77b8452

  • SSDEEP

    768:xxT8RY10ew25PbGU98RYRlpsZebyk+AnYgQThfnDTdt9z:xiyhGU98CDpsZeb7ng

Score
10/10
guloaderdownloaderguloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1x3EIvAyvaXVzTC7xfLdkikFqCA1reHig

xor.base64

Targets

    • Target

      46ca6b60ad6492b4548cb25c5e7ff6981bf7f0a7961743222dc3f25d1f12280b

    • Size

      60KB

    • MD5

      daaff39b3854fe5ef5427eec52265fd8

    • SHA1

      4ad3c1cbfc9a19a245195e5044d53a2d26e447f7

    • SHA256

      46ca6b60ad6492b4548cb25c5e7ff6981bf7f0a7961743222dc3f25d1f12280b

    • SHA512

      aa24e27ea4b92dc55abb6f071f03e8f1b99125ee71716d6e66bc969e0d680d5d9d6147946a2a58a72860f4bc8ee630a4ed9c60c676aad610bd00e177c77b8452

    • SSDEEP

      768:xxT8RY10ew25PbGU98RYRlpsZebyk+AnYgQThfnDTdt9z:xiyhGU98CDpsZeb7ng

    Score
    10/10
    guloaderdownloaderguloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader payload

      guloader

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks