General
- Target e0d35d2fe887cbe0b4de87f1be7d7a17.bin
- Size 439KB
- Sample240501-cb3pbsdd2y
- SHA256 1ccfac0d54e9252032fbe4ebb2d47f346fa479ebd24c9bc1cece585baa6283cf
Score
10/10
Malware Config
Targets
-
- Target 1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010.exe
- Size 563KB
- SHA256 1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
Score3/10