Overview

overview

10

Static

static

e5d7545dfa...91.exe

windows7-x64

10

e5d7545dfa...91.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5d7545dfadb893067bf066e70f2dbe29e007b47befdf0743d71d07e1c262e91

  • Size

    241KB

  • Sample

    221209-rq95aadd36

  • MD5

    d7a778b1b1ea5c966fc63d1d5238e10c

  • SHA1

    d61399065129c621a8ac389736029fd404e06cb1

  • SHA256

    e5d7545dfadb893067bf066e70f2dbe29e007b47befdf0743d71d07e1c262e91

  • SHA512

    7c727dd658cac00b4dbf5a3f6f54f356748ff02523e88ad8836a599ce62af018f6a19f8067cab54dcf44b23ed98795957eb13dbf2ebae88d4797230bdfdddc10

  • SSDEEP

    3072:2fY/TU9fE9PEtuecPSQbuLO1DF/vTiYQb/20FwL44h8ond4WHEJyhUlFrEP9sb08:gYa6wkSQbXx/vTg/2ysnQpksb1D9CK

Score
10/10
guloaderdownloaderpersistence

Malware Config

Targets

    • Target

      e5d7545dfadb893067bf066e70f2dbe29e007b47befdf0743d71d07e1c262e91

    • Size

      241KB

    • MD5

      d7a778b1b1ea5c966fc63d1d5238e10c

    • SHA1

      d61399065129c621a8ac389736029fd404e06cb1

    • SHA256

      e5d7545dfadb893067bf066e70f2dbe29e007b47befdf0743d71d07e1c262e91

    • SHA512

      7c727dd658cac00b4dbf5a3f6f54f356748ff02523e88ad8836a599ce62af018f6a19f8067cab54dcf44b23ed98795957eb13dbf2ebae88d4797230bdfdddc10

    • SSDEEP

      3072:2fY/TU9fE9PEtuecPSQbuLO1DF/vTiYQb/20FwL44h8ond4WHEJyhUlFrEP9sb08:gYa6wkSQbXx/vTg/2ysnQpksb1D9CK

    Score
    10/10
    guloaderdownloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks