guloader | 674513ed93814fbb23120697985d3f960308deeb62388ff2033c2a3729da2fc3

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:27

Target

674513ed93814fbb23120697985d3f960308deeb62388ff2033c2a3729da2fc3.exe
Size

48KB
MD5

98198a0d73bc39775d611cf35d93959b
SHA1

714f96a9ab2425518bb8c2879f74c86b2420ab33
SHA256

674513ed93814fbb23120697985d3f960308deeb62388ff2033c2a3729da2fc3
SHA512

d72cf8ee46132ef8a5b3e32a885042e7de9129aae5e2cdd892fa57343f94486ec1054b22d0c9227499bfb56e24270e449cb504ef93b00b9953a2e35eed8894d2
SSDEEP

768:tXlHaC8SxVcgQ//GHLpJDMAjVcehSUwzZ:HP8SkD//GrrDTqF

Score

10^/10

Family

guloader

https://www.villavic.com.br/bin_sOErg177.bin

http://103.141.138.118/bin_sOErg177.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

674513ed93814fbb23120697985d3f960308deeb62388ff2033c2a3729da2fc3.exe

pid process

4716 674513ed93814fbb23120697985d3f960308deeb62388ff2033c2a3729da2fc3.exe

pid	process
4716	674513ed93814fbb23120697985d3f960308deeb62388ff2033c2a3729da2fc3.exe

C:\Users\Admin\AppData\Local\Temp\674513ed93814fbb23120697985d3f960308deeb62388ff2033c2a3729da2fc3.exe
"C:\Users\Admin\AppData\Local\Temp\674513ed93814fbb23120697985d3f960308deeb62388ff2033c2a3729da2fc3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4716

memory/4716-134-0x00000000021D0000-0x00000000021D9000-memory.dmp

Filesize
36KB

Download
memory/4716-135-0x00007FF832C10000-0x00007FF832E05000-memory.dmp

Filesize
2.0MB

Download