Overview

overview

10

Static

static

3

5a3780864f...8e.exe

windows7-x64

10

5a3780864f...8e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5a3780864f2c0b86442944e6c0372fbf8dab2e00015a1ddbfd2949b781505f8e

  • Size

    120KB

  • Sample

    230718-ky77bsaa5x

  • MD5

    2d568d6eb02203d24953a84f200691a5

  • SHA1

    6b37dda46419fdfc1e691e9809c81e1aaf6e49ae

  • SHA256

    5a3780864f2c0b86442944e6c0372fbf8dab2e00015a1ddbfd2949b781505f8e

  • SHA512

    eb8798c112e36a98a50b75e9b1854c0c2e92eb7f8ab0e2f596d6c8cec33cb78c6a55e33987a6bb7dba1d7f7747473d8c7fed27f824101547701dac98a79e21fa

  • SSDEEP

    768:SEeu3MlyecTHVuY1E9tSCbhdoObqrrhR8EQKYKT8Y2jPh3UbpPzEo7Zu:dezlZsHLK90IHKhWNKTn2jZk1L/s

Score
10/10
guloaderdownloaderguloaderpersistence

Malware Config

Targets

    • Target

      5a3780864f2c0b86442944e6c0372fbf8dab2e00015a1ddbfd2949b781505f8e

    • Size

      120KB

    • MD5

      2d568d6eb02203d24953a84f200691a5

    • SHA1

      6b37dda46419fdfc1e691e9809c81e1aaf6e49ae

    • SHA256

      5a3780864f2c0b86442944e6c0372fbf8dab2e00015a1ddbfd2949b781505f8e

    • SHA512

      eb8798c112e36a98a50b75e9b1854c0c2e92eb7f8ab0e2f596d6c8cec33cb78c6a55e33987a6bb7dba1d7f7747473d8c7fed27f824101547701dac98a79e21fa

    • SSDEEP

      768:SEeu3MlyecTHVuY1E9tSCbhdoObqrrhR8EQKYKT8Y2jPh3UbpPzEo7Zu:dezlZsHLK90IHKhWNKTn2jZk1L/s

    Score
    10/10
    guloaderdownloaderguloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader payload

      guloader

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks