guloader | 88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246

General

Target
88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246
Size 489KB
Sample240502-rkkmfacf92
SHA256 88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246
MD5 cbfe477536e5434005ec40a22c8b79ee
SHA1 2fb42b99bb51041bbbe2da96125aeb95ec1b4c02
SHA512 beea18bc954059a6418dd4b7548350dcf95d4d3eb14b9dc7fa32b11d3e558bce57be765cddbf99de32cead9f3f4a37f57558c031337db49e000d0fae1b214365
SSDEEP 12288:pnPdsC9RjSmHcRhoKm3H4yfDBobpx2LzY9dW8FNOgM:1PdZWmHECHpBEpILzY9dW8+gM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246
- Size 489KB
- SHA256 88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246
- MD5 cbfe477536e5434005ec40a22c8b79ee
- SHA1 2fb42b99bb51041bbbe2da96125aeb95ec1b4c02
- SHA512 beea18bc954059a6418dd4b7548350dcf95d4d3eb14b9dc7fa32b11d3e558bce57be765cddbf99de32cead9f3f4a37f57558c031337db49e000d0fae1b214365
- SSDEEP 12288:pnPdsC9RjSmHcRhoKm3H4yfDBobpx2LzY9dW8FNOgM:1PdZWmHECHpBEpILzY9dW8+gM
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader execution persistence collection
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Amphioxidae.Zin
- Size 56KB
- SHA256 a60d0460a7535d710c8083d2801309c85e4c4799657a555d8b50eb413f9bf485
- MD5 de3e908d8a9b4efd29f77f55d5305c5b
- SHA1 054248535582ddd0d7bb25c5c4757a9166763a15
- SHA512 e6a56f4fd7e9ef71bc874df03d822f349470ac4e13a8acfb16b2134e83579c7250cf8cb323ec17c9cb288601e51b9c615a57cbb403b85a3b35ff1ef3f6dae001
- SSDEEP 768:m0xiUN/THk8c1Sj0n4pWSEQjVtcNd0cNdKFVJhYRsex2bxkqsIzzMqA+CA49:WUN/THkT1SvpWvQhtcv+FVH3D/PA/B9
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

execution persistence
- Modifies Installed Components in the registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4