guloader | c92791b7719c410885432385c668313a7e75d9ce152bab6192ba4d657ef052eb | Triage

Sharing

General

Target

c92791b7719c410885432385c668313a7e75d9ce152bab6192ba4d657ef052eb
Size

236KB
Sample

230129-srq88sde7z
MD5

0af9899535e4e01ca5f462698b4daf76
SHA1

b45e55bb808b2d6474948751d6e5222dd1681f25
SHA256

c92791b7719c410885432385c668313a7e75d9ce152bab6192ba4d657ef052eb
SHA512

a8083a5daabddb4882beaaf94ce6cc984db46900610161cde796ef7e0341ee1cb7ab59947b06401336a00a64016e5dde8f75f71953a873c7da2ba3a1526ddc59
SSDEEP

6144:NdEW6JwLKqkYUogiOi7iiviii2lALi+i9iiai1iiqiriiBiSiiPiiiifkEM6r:QW

Score

10^/10

guloader downloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=142oHWKDKlfvcA-f2uT-IvYwcaK4snG7A

xor.base64

Targets

- Target
  
  c92791b7719c410885432385c668313a7e75d9ce152bab6192ba4d657ef052eb
- Size
  
  236KB
- MD5
  
  0af9899535e4e01ca5f462698b4daf76
- SHA1
  
  b45e55bb808b2d6474948751d6e5222dd1681f25
- SHA256
  
  c92791b7719c410885432385c668313a7e75d9ce152bab6192ba4d657ef052eb
- SHA512
  
  a8083a5daabddb4882beaaf94ce6cc984db46900610161cde796ef7e0341ee1cb7ab59947b06401336a00a64016e5dde8f75f71953a873c7da2ba3a1526ddc59
- SSDEEP
  
  6144:NdEW6JwLKqkYUogiOi7iiviii2lALi+i9iiai1iiqiriiBiSiiPiiiifkEM6r:QW
Score

10^/10

guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

guloaderdownloader

behavioral2

guloaderdownloader