guloader | e99697188323e143ea9f2f595726cff836de361dfae04a2d461545a7c70d5483

General

Target
Evgh.bin
Size 437KB
Sample240430-nxt5vsbe7z
SHA256 e99697188323e143ea9f2f595726cff836de361dfae04a2d461545a7c70d5483
MD5 7a31a25ab61dbd164950a2f144c944a6
SHA1 974ef264762ac0b0dc076182f78052e6c1ecffca
SHA512 3aba2b165d6d726b6ec325b7815652cf1f69e7664191ac3e5de5ee756b0d49a1e89eec5432dabc11def6128bca2a15e417439a082051465f1bd3d357ddd8252c
SSDEEP 6144:o7pnisY3azNhyyBTaqkZHH7pNc8NBeHeJOKRwB0mcTY0TYpx9AJDqCLbdu6/y0Bv:LsY36bBTStHnNBqIOQRLTa9A9Zj3ZH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Evgh. rvs Armenia. 30.04.2024.exe
- Size 783KB
- SHA256 0d8b7479bd9156032cf3287faee1807e96d68c7bce3835c7e3435951446bade1
- MD5 6775321bbbe02737daff72cbfef1d3a5
- SHA1 778fb1443b71b7afbf8965d6fad12247c7e2befc
- SHA512 0970f311b772c014384a17d0c3b51a47f7046096d2d140db7fbe665087369fde3123c77283304121ac37517a3aa117787c42914884ec82f985ddf88c7531b810
- SSDEEP 12288:DrC48OWaxjjtjj9bHGMIvxV7G5iMOQrLTI9AVZ/RZF:H7/jxjjtjj9JIvxV7G5iMN/0GZ/RZF
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader persistence collection
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Attn104/Jiber/Superintendentens/Chaptaliseringernes.Kro
- Size 59KB
- SHA256 b7d771d62b14d618608d7541302035b824e69cee7a497ab326a14e7562800f3a
- MD5 7a00c4088c123d61422f4fe0db41bd24
- SHA1 8dcb56788e82418c69556771808bb6c7b977067f
- SHA512 e5c309d5d1cec2083750e242d901f8bdc3a845018603f6ed16436f65ebda2e1e7f5978ac3dc838199cae22ab7b0c12c930cf941bb25c33886731d76c5598ae37
- SSDEEP 1536:YZzbiRU2WUoHhEBe6aOe0P2vG2Ib4OO5S3oaT:gzbUUnU2hmVaM2vR7NS3d
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4