guloader | cf43a0cb9336edd836e5a2569e6c6f972ae193143b3740bacf09be78ac80a928 | Triage

Sharing

General

Target

DHL online Customer AWB Shipping%0D%0A%09Docs.Commercial Invoice. Packing List. BL Draft%0D%0A%09THS0094587231.pdf.r27.rar
Size

393KB
Sample

221220-reeh8shg74
MD5

289a5e3b88ef5a991b7ebca99edf0189
SHA1

90ed1e94082173adbb959af495325c111202593e
SHA256

cf43a0cb9336edd836e5a2569e6c6f972ae193143b3740bacf09be78ac80a928
SHA512

62415d90e65787b31b0ba95aa1ce52c882f96883e81b0eea88be3364af7923670cc81d62d2960c9ecf0cec675056ee450c5512d1820087b90c9576147f6d9db2
SSDEEP

6144:wkNXUXxb13nW3N0djwIb+32DKHM74J5S7D/QCPkcKrVYu9Tx5C2KOh8TRAlrh1Zm:5KbxW90mDGu44G9Hu9FQUh4RErB54

Score

10^/10

guloader discovery downloader

Malware Config

Targets

- Target
  
  DHL online Customer AWB Shipping Docs.Commercial Invoice. Packing List. BL Draft THS0094587231.pdf.exe
- Size
  
  513KB
- MD5
  
  a52478e75fbb20e4d0c2de385db1b3ce
- SHA1
  
  ed9a76bd4c286c2b7ffa7b0bf5b66db2a1eb1088
- SHA256
  
  88784edc4183537c005102816de40a74499b1261a416eb02fcf1dbcc634b349b
- SHA512
  
  d2e0abab3c5bc436f2131d231761ba2539a9280781b3fa7eeac3f6a4a8c9d38c7d5d0ccdea952c5c2fe91e0803467eef1a583defedf7e7efd4d561d5d2d31d1c
- SSDEEP
  
  12288:L3LuHzF7bje6/+3lRe+Q3JRtB1Ir/YJGPm030VDbHQ:WTF7PK3lRe+W5D8/YguHQ
Score

10^/10

guloader discovery downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderdiscoverydownloader

behavioral2

guloaderdownloader