guloader | 75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 15:54

Target

75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe
Size

120KB
MD5

64f9a258a7b5ea2e7b6d721dabd43b35
SHA1

309b590a9c95321c50558fc7ac64b6bef6a4c6bd
SHA256

75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570
SHA512

951f325d447e7878681e33e62ac27abfff1ee599a97c65e1a1835cef97edaa9e41159d8814dd8d26a02516cae456a8f1b33b8562abb32e66edaa991957eb903c
SSDEEP

768:bGogmHSReVkFTodr8RnS6C1e6MZYj0BTt6k+S/avEQIcAHg5GcGkDNwVGFQ6Uztj:bIySg8SXrM+4LmEQyePsVtFjeMb

Score

10^/10

Family

guloader

https://www.feeclng.com/rubbing/filing.bin

https://parisgallery.com.my/rubbing/filing.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/952-56-0x0000000000440000-0x000000000044B000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe

pid process

952 75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe

pid	process
952	75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe

C:\Users\Admin\AppData\Local\Temp\75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe
"C:\Users\Admin\AppData\Local\Temp\75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:952

memory/952-56-0x0000000000440000-0x000000000044B000-memory.dmp

Filesize
44KB

Download
memory/952-57-0x0000000077020000-0x00000000771C9000-memory.dmp

Filesize
1.7MB

Download