guloader | 8fc0408c5e21a18b67c982b47866c878488f3cacd09eb8cea3404d4b06744b80

Analysis

max time kernel
12s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:27

Target

8fc0408c5e21a18b67c982b47866c878488f3cacd09eb8cea3404d4b06744b80.exe
Size

100KB
MD5

55806781bf037085d7e0abfe869f48fb
SHA1

7b4465eb6029da4e6c3ee39e081dc9431e477d34
SHA256

8fc0408c5e21a18b67c982b47866c878488f3cacd09eb8cea3404d4b06744b80
SHA512

bbddbf834e60987064084369ef0cb24fb58ae245b1df1388e2f25334d3425f3b7fcc6d53d7d6b7166536bdcbb0bdd021fa478ed4d5355fd8c6d5f58dabe1d571
SSDEEP

1536:B9qHzy+j6ajXXnHG94m77JBAv2/A+vbIXQd:B9qTTjn07FBAGvr

Score

10^/10

Family

guloader

https://victoragboifo.com/ui/janomo_cNCpTlEgTW135.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1584-56-0x00000000003C0000-0x00000000003CC000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8fc0408c5e21a18b67c982b47866c878488f3cacd09eb8cea3404d4b06744b80.exe

pid process

1584 8fc0408c5e21a18b67c982b47866c878488f3cacd09eb8cea3404d4b06744b80.exe

pid	process
1584	8fc0408c5e21a18b67c982b47866c878488f3cacd09eb8cea3404d4b06744b80.exe

C:\Users\Admin\AppData\Local\Temp\8fc0408c5e21a18b67c982b47866c878488f3cacd09eb8cea3404d4b06744b80.exe
"C:\Users\Admin\AppData\Local\Temp\8fc0408c5e21a18b67c982b47866c878488f3cacd09eb8cea3404d4b06744b80.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1584

memory/1584-56-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/1584-57-0x0000000076F30000-0x00000000770D9000-memory.dmp

Filesize
1.7MB

Download