Overview

overview

10

Static

static

caad589daa...a4.exe

windows7-x64

10

caad589daa...a4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    caad589daa525d04613405455e0304f0197ea33a3aa9e8152a99249dac2f42a4

  • Size

    132KB

  • Sample

    230129-1wb9waed82

  • MD5

    dfdbbafef5cf6b3358a099dac867fec6

  • SHA1

    fa970f770679a60d0eea9f7e834414335a547721

  • SHA256

    caad589daa525d04613405455e0304f0197ea33a3aa9e8152a99249dac2f42a4

  • SHA512

    5f248feb2c07bd8041d54d620219ef807cdbaa296d657b73063ec38093588049cc12f190164433a9c3be7278b63e5cb224f2e173117426b52c61a004df362b30

  • SSDEEP

    1536:AZHtnIRYS5/Cac/Lo58OT4o/jbkZGcEXH+zX6JaB4a1L73rGUn2MEz:Ph6g8CRTHSNB4a137GU2X

Score
10/10
guloaderdownloaderguloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1-HLxBTGgDQAJoi4W7itkL8n6nA0XOFJK

xor.base64

Targets

    • Target

      caad589daa525d04613405455e0304f0197ea33a3aa9e8152a99249dac2f42a4

    • Size

      132KB

    • MD5

      dfdbbafef5cf6b3358a099dac867fec6

    • SHA1

      fa970f770679a60d0eea9f7e834414335a547721

    • SHA256

      caad589daa525d04613405455e0304f0197ea33a3aa9e8152a99249dac2f42a4

    • SHA512

      5f248feb2c07bd8041d54d620219ef807cdbaa296d657b73063ec38093588049cc12f190164433a9c3be7278b63e5cb224f2e173117426b52c61a004df362b30

    • SSDEEP

      1536:AZHtnIRYS5/Cac/Lo58OT4o/jbkZGcEXH+zX6JaB4a1L73rGUn2MEz:Ph6g8CRTHSNB4a137GU2X

    Score
    10/10
    guloaderdownloaderguloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader payload

      guloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks