guloader | 663d26dcbb8d892f986086c207e27519f16c23846c1c905c3412c3adef674b8d

General

Target
663d26dcbb8d892f986086c207e27519f16c23846c1c905c3412c3adef674b8d
Size 1.1MB
Sample240118-2rx68acgfr
SHA256 663d26dcbb8d892f986086c207e27519f16c23846c1c905c3412c3adef674b8d
MD5 3c145256de73bb0cac0f4c64dc4ee510
SHA1 abccc8f3dbe4ef98753de389c6214cd125bf2b89
SHA512 51acab40623257b98df7eec6dd79df85c76c5e1b406cf1ff07b2626798cac620352d447cb42ec3bef9f26db97b27133418464c671812e888040eaf164f18b419
SSDEEP 24576:9hLScdA4h7gUmMFUIttttXzjCnVXF3l4JOoBTzGgI6CsFAH5uefO5bb:vScdAC7gUmkHt/XXCnV9BuquCzlubb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Targets

- Target
  663d26dcbb8d892f986086c207e27519f16c23846c1c905c3412c3adef674b8d
- Size 1.1MB
- SHA256 663d26dcbb8d892f986086c207e27519f16c23846c1c905c3412c3adef674b8d
- MD5 3c145256de73bb0cac0f4c64dc4ee510
- SHA1 abccc8f3dbe4ef98753de389c6214cd125bf2b89
- SHA512 51acab40623257b98df7eec6dd79df85c76c5e1b406cf1ff07b2626798cac620352d447cb42ec3bef9f26db97b27133418464c671812e888040eaf164f18b419
- SSDEEP 24576:9hLScdA4h7gUmMFUIttttXzjCnVXF3l4JOoBTzGgI6CsFAH5uefO5bb:vScdAC7gUmkHt/XXCnV9BuquCzlubb
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Striberne/Unarresting/Heronite/Renegerer91/Chunkhead.Log
- Size 23KB
- SHA256 5cc9d25fe860cde720c0c2beb0e249f8c875edcfcc967712d5b1135a000997c3
- MD5 ee72094e3ff68e9f1f60b83f304dfb32
- SHA1 4ad3ef4daf56db8a7172990e076ee99ab2ce31c0
- SHA512 17c8444c9a5c0afb212e97302562a84cb38a9de4188c7086676b33e1a885fd19d7095a11d968db78b2ec374b7f04362cb8ca5372b28a3ff1b950c43c340513b5
- SSDEEP 384:COKecD0uYVoIirZhNEPCrm38Qfj42UbfEvDmsUNF0zb4wDMP6BjfutJq91Ya5TvN:3KeOLNtdQhUbcvasKGzb4wDq4butJAYM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Checks computer location settings

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4