guloader | 6cf582f86922a41aeda99e73ba87b510af5d9a4718a53c0716b35843d5734e3c

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:21

Target

6cf582f86922a41aeda99e73ba87b510af5d9a4718a53c0716b35843d5734e3c.exe
Size

68KB
MD5

18c769ac1542fcc0f52198ec35f9c39c
SHA1

2a85bdd6e513db0ec7cf7f2f1917217e8d1c1ed3
SHA256

6cf582f86922a41aeda99e73ba87b510af5d9a4718a53c0716b35843d5734e3c
SHA512

aaaa68fda25db72367ff9f42776bc73516309d1f3c54cdfd193830e864e618534471f0341122710dbf063fa9a76f9ccaaf44bff2c7995cdccb7d38f2360a5a85
SSDEEP

1536:mXpbiQyBCxOiMa9mTt6A7kQ1Onmcz0+DMG9ASrX:mRiQyBCxOiexYQOmkDDv9Jr

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1LtFcew4Be3RhBJmot7KxhdkNCxmvmban

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1292-56-0x0000000000360000-0x000000000036B000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6cf582f86922a41aeda99e73ba87b510af5d9a4718a53c0716b35843d5734e3c.exe

pid process

1292 6cf582f86922a41aeda99e73ba87b510af5d9a4718a53c0716b35843d5734e3c.exe

pid	process
1292	6cf582f86922a41aeda99e73ba87b510af5d9a4718a53c0716b35843d5734e3c.exe

C:\Users\Admin\AppData\Local\Temp\6cf582f86922a41aeda99e73ba87b510af5d9a4718a53c0716b35843d5734e3c.exe
"C:\Users\Admin\AppData\Local\Temp\6cf582f86922a41aeda99e73ba87b510af5d9a4718a53c0716b35843d5734e3c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1292

memory/1292-56-0x0000000000360000-0x000000000036B000-memory.dmp

Filesize
44KB

Download
memory/1292-57-0x00000000770A0000-0x0000000077249000-memory.dmp

Filesize
1.7MB

Download