guloader | 2db92a3fa08dc8e97b4f2651e9ec1d123d2556ce5bc7ec9474672767f6505e26

General

Target
IMG-ORDER-Comex-3264775737745728821842424ZZ.exe
Size 2.0MB
Sample240220-htsvqsda7t
SHA256 2db92a3fa08dc8e97b4f2651e9ec1d123d2556ce5bc7ec9474672767f6505e26
MD5 56080cfd42fa3713f8e338b7c43b3c58
SHA1 296ed8c2990562aafec3990541cefdd65da03974
SHA512 b13027c40db1e342ed78b8858719be164a56a969feb963b48c65a79cb941e82589b54c69cbe97d888ec164826a363edbd55531ede2299ef5dbc0ec27c99b51b4
SSDEEP 49152:rtcVOUULvCUAf9JvhGTP+2Nv4JVClDq0LvoZo358R2h+A:BcV8S1RID+YviYCe588h+A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  IMG-ORDER-Comex-3264775737745728821842424ZZ.exe
- Size 2.0MB
- SHA256 2db92a3fa08dc8e97b4f2651e9ec1d123d2556ce5bc7ec9474672767f6505e26
- MD5 56080cfd42fa3713f8e338b7c43b3c58
- SHA1 296ed8c2990562aafec3990541cefdd65da03974
- SHA512 b13027c40db1e342ed78b8858719be164a56a969feb963b48c65a79cb941e82589b54c69cbe97d888ec164826a363edbd55531ede2299ef5dbc0ec27c99b51b4
- SSDEEP 49152:rtcVOUULvCUAf9JvhGTP+2Nv4JVClDq0LvoZo358R2h+A:BcV8S1RID+YviYCe588h+A
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader persistence
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
- MD5 55a26d7800446f1373056064c64c3ce8
- SHA1 80256857e9a0a9c8897923b717f3435295a76002
- SHA512 04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
- SSDEEP 192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  Metallochromy206.Com
- Size 210KB
- SHA256 1047db547dcb4ba15d1baeca02f3c0b66ab402b48e7e3148891b97fd50c9ddee
- MD5 b89766549f27396708f6760caf984efb
- SHA1 db8d188fb71b661e1bfc8eb66b461341ee1a5d84
- SHA512 2cfa0192ea7a8359d9499f7732e311fb49085bde231be238a4d0165b59337d057514535afce709f0718eb772e8553c1d58f7318eea4c7d2eef249ccd31a8b9b1
- SSDEEP 3072:8G2UsGqbUBO0qr6hEydLjrmTYPem3vbI1LOhPHZVjyk6ajYR934mHBy:aGqgOl6+ylCTBQIt8P59yxa634SI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6