Overview

overview

10

Static

static

1

ac18a10570...af.xxe

windows10-2004-x64

3

statement-...CC.vbs

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ac18a105704e785c3f515987431c9eaf
  • Size 14KB
  • Sample230809-mq46taae83
  • SHA256 1e32bb91dccab3917339ab16f945cde34cc1239a6eacc749cf157258b36d4fa9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
guloaderdownloader

Malware Config

Targets

    • Target
      ac18a105704e785c3f515987431c9eaf
    • Size 14KB
    • SHA256 1e32bb91dccab3917339ab16f945cde34cc1239a6eacc749cf157258b36d4fa9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral1
    • Target
      statement-Invoices-9098847251-DB_aabgaibajf0x0CCC_126KB__aabgaibajf0x0CCC.vbs
    • Size 10KB
    • SHA256 6ad1016df67ae1100b4a73b2a1bd4592fcc39a063e9446b8abda5f8a75d47420
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral2

MITRE ATT&CK Enterprise v15

Tasks