General

  • Target

    ORDER 38098.COM

  • Size

    545KB

  • Sample

    240322-qc774abh72

  • MD5

    af7981a2ac42f21ac4820f14bbb294b2

  • SHA1

    51d83fde26f84015365231c9526cc26adf2e3bf0

  • SHA256

    8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c

  • SHA512

    866320fc0b724695cfa9e1abf2f673ab48150bdab109f30106bd838ca3ba6aa5e50eb554e217e2bec974065a5a0ecb735d65abc5c8493abe1d14537ca73c1ef1

  • SSDEEP

    6144:lp+ggeIHjncXksyUHxAqJ1LGmg8EmDu7dRQ26RihUvqhEYGZtrLBU91BscRt1y/n:7XYvfs1c8JGRQ2UicttUjy82Ki5p

Malware Config

Targets

    • Target

      ORDER 38098.COM

    • Size

      545KB

    • MD5

      af7981a2ac42f21ac4820f14bbb294b2

    • SHA1

      51d83fde26f84015365231c9526cc26adf2e3bf0

    • SHA256

      8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c

    • SHA512

      866320fc0b724695cfa9e1abf2f673ab48150bdab109f30106bd838ca3ba6aa5e50eb554e217e2bec974065a5a0ecb735d65abc5c8493abe1d14537ca73c1ef1

    • SSDEEP

      6144:lp+ggeIHjncXksyUHxAqJ1LGmg8EmDu7dRQ26RihUvqhEYGZtrLBU91BscRt1y/n:7XYvfs1c8JGRQ2UicttUjy82Ki5p

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      75ed96254fbf894e42058062b4b4f0d1

    • SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

    • SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    • SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • SSDEEP

      192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks