Overview

overview

10

Static

static

1

c942fb1849...79.exe

windows7-x64

10

c942fb1849...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8973313970.zip

  • Size

    342KB

  • Sample

    230202-tfgq4ahf9y

  • MD5

    25e377df80fadade0b89ce9ec8e7f75b

  • SHA1

    c6da686095450daccd5fb651ecdf542bf44f4ee8

  • SHA256

    1d23717121434089c2ad8f379f1691c42091704a5742ad688e1cd17c6c52f266

  • SHA512

    4773d3c7dc2e64cd50c3fca441d92193c2e73d5229cdcabf7bd3f38863e50046f9a47791e5bc757ef29e596cb54a2e054383f5e500521e4247f129527b5d51b9

  • SSDEEP

    6144:TOqOHkqKHnl66AejFy7CIdfLcyCLL/qqzKDTluDC6GyiOpsiCc85A9wETCRPFSbB:TOqOHhino6hE1QyCLLFKDURGEWibXzSq

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      c942fb184930197000a272bb568bb1744c906f95ec0d1cdd3387971e0fb21c79

    • Size

      371KB

    • MD5

      1c058fa9d84f8a6c03f1cc95ec306df4

    • SHA1

      14160aedb7da83d8da8cf1a3e5a07837ae472f4f

    • SHA256

      c942fb184930197000a272bb568bb1744c906f95ec0d1cdd3387971e0fb21c79

    • SHA512

      463e97a3d5141ddc5c89d0a9230a3e6a1ef287413896934868b949c4fe94f7e59ae40dcf2a7187af1db823ddd52a6719c40d4f2a5b0917b82e9ced8dfe72ba46

    • SSDEEP

      6144:HY2LjnXgw9HpYRWiXy+akwOPU0ZL4Kq0Xe+tSZnJ8bChtWejOrMgt/8CYhFYunEC:hjnXgw9Hp1ii+akwUUCL4T4StiatWJZm

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks