guloader | 43319fa796c6b542426e4e853a26a12d9a1cd49687878484a5bae88d246600cb

General

Target
z6FORMATOPROVEEDORESMETAX.exe
Size 383KB
Sample240429-xrhdjsad32
SHA256 43319fa796c6b542426e4e853a26a12d9a1cd49687878484a5bae88d246600cb
MD5 23e67f856583bc4edbab6d66fb5d3519
SHA1 335d696e7448570c632dc0b6f3aadfe69262d2ef
SHA512 893f81e5c0a8e64b4a2ab2edee73b7867255154191cd73ca9faddfc3c7c68454689dc3b297c7cf3bb51f14f3910fb9c0ff6f1ce5f1139961a8153e54c9868ffc
SSDEEP 6144:HT4DtVpZI3UNWc3n5C3Tsc8XANjZ8S+ztjsNtsZ7X9/wkm8mKuUE2OCQpPAvFeVY:HTgYEztxwquUfNQZAvsl9pSTlDt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  z6FORMATOPROVEEDORESMETAX.exe
- Size 383KB
- SHA256 43319fa796c6b542426e4e853a26a12d9a1cd49687878484a5bae88d246600cb
- MD5 23e67f856583bc4edbab6d66fb5d3519
- SHA1 335d696e7448570c632dc0b6f3aadfe69262d2ef
- SHA512 893f81e5c0a8e64b4a2ab2edee73b7867255154191cd73ca9faddfc3c7c68454689dc3b297c7cf3bb51f14f3910fb9c0ff6f1ce5f1139961a8153e54c9868ffc
- SSDEEP 6144:HT4DtVpZI3UNWc3n5C3Tsc8XANjZ8S+ztjsNtsZ7X9/wkm8mKuUE2OCQpPAvFeVY:HTgYEztxwquUfNQZAvsl9pSTlDt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader persistence collection
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  jebliksbilledes/Unrelative/Sikkativers/Regredieredes/Fastkurspolitikken.Vol
- Size 60KB
- SHA256 f383eb80238916fd6c00c1513464f841fefb622aad04f345f4bc69f8a24aa8b1
- MD5 2a4c059165f67c3923409c13eb335f08
- SHA1 327454ea9cef3b257a7a154bc75aa1dac1dc77d1
- SHA512 d1d1898f852d9fb3af766fea3e06ffefad91af0bc4d5652716103f6f2151118b5129d8c9707fcaf14d3e16654f7148163b80ec03a3e2a4bbb036575666392560
- SSDEEP 768:bxvCc7TZ/G5kUwtoHQsp55qLP4vozxzNVqsZPiL3B3uy1LnUIz75zx7IwUER81uu:1qJ+ltCWP3NzNVqLj5bDd9NxouDgUSV
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4