guloader | 169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee | Triage

Sharing

General

Target

169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee
Size

216KB
Sample

230116-2kq5bsef66
MD5

509a790f29b511f6da99dab521f82b4f
SHA1

af60c982d11400133e1d6bde8face07ac7133949
SHA256

169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee
SHA512

8ddc94e9cf41e9fa693a0a72b6847e5b925ce9ac28be646cfb6824d8709c53ba3012dc19774e01888aeacf35f2b57331b417b4be02d3f3cc4f7dadbf0c761720
SSDEEP

6144:E3hqLCa8aAYFHHHHHHHHHHv8BVBb9aAxAYD7xTBegDHqnFD873K7UzB:E3zCFHHHHHHHHHHvCBb9ZJf/egDbFB

Score

10^/10

guloader discovery downloader

Malware Config

Targets

- Target
  
  169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee
- Size
  
  216KB
- MD5
  
  509a790f29b511f6da99dab521f82b4f
- SHA1
  
  af60c982d11400133e1d6bde8face07ac7133949
- SHA256
  
  169b591d42ac6dac4d0c5b803e6c4edcab60608f0983a8334339857e4a7588ee
- SHA512
  
  8ddc94e9cf41e9fa693a0a72b6847e5b925ce9ac28be646cfb6824d8709c53ba3012dc19774e01888aeacf35f2b57331b417b4be02d3f3cc4f7dadbf0c761720
- SSDEEP
  
  6144:E3hqLCa8aAYFHHHHHHHHHHv8BVBb9aAxAYD7xTBegDHqnFD873K7UzB:E3zCFHHHHHHHHHHvCBb9ZJf/egDbFB
Score

10^/10

discovery guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

guloaderdiscoverydownloader