guloader | 1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010

General

Target
6000507958.exe
Size 563KB
Sample240424-bcr4jsdd33
SHA256 1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010
MD5 e0d35d2fe887cbe0b4de87f1be7d7a17
SHA1 b37f59b0ec54d6c40645837dbb3a18c954346601
SHA512 9d20fd479a57ccf51c02830744f095b5dfa98707777a8f24968aa0f0e9ac2a4de4ae348831a001b00cae9d750b9372a85248fdd15570a44ca52b90f8cf451256
SSDEEP 12288:8stfWr2z5t/dtpQBEd6XT9Pi8RzDm+EYRfT7d+:8st+r2z5J9Pd6XT9Pi85REYpT7d+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  6000507958.exe
- Size 563KB
- SHA256 1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010
- MD5 e0d35d2fe887cbe0b4de87f1be7d7a17
- SHA1 b37f59b0ec54d6c40645837dbb3a18c954346601
- SHA512 9d20fd479a57ccf51c02830744f095b5dfa98707777a8f24968aa0f0e9ac2a4de4ae348831a001b00cae9d750b9372a85248fdd15570a44ca52b90f8cf451256
- SSDEEP 12288:8stfWr2z5t/dtpQBEd6XT9Pi8RzDm+EYRfT7d+:8st+r2z5J9Pd6XT9Pi85REYpT7d+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader persistence
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
- MD5 5aa38904acdcc21a2fb8a1d30a72d92f
- SHA1 a9ce7d1456698921791db91347dba0489918d70c
- SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
- SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4