Overview

overview

10

Static

static

3

15f0a22c06...18.exe

windows7-x64

6

15f0a22c06...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118

  • Size

    120KB

  • Sample

    240505-ewdxtahh33

  • MD5

    15f0a22c06c2be78c39e1917e2e798ca

  • SHA1

    7c2c3fe1b56f19376aca59d0cc44fe4614ec4f65

  • SHA256

    b0e40f83154bce1343f616094c5c67fb9991f06aa7a0fb1915f952e40c3d1bba

  • SHA512

    a40175c1bd27a94a417be7487783dd6f36d454bbe353805aa217990410bb664d4f835cce57d3c0fdc65f98be290bab0cd8eed7541793a38be2bec69260b8a3b4

  • SSDEEP

    1536:qurIK51KOzsoK+dtPVpiudZNeLXWB/LnT0MWkbT3y+:3JEL4Xk6Zv3WO3y+

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=153DKiqSWVZMTgNlP2Tv0lSIALRl9DHhS

xor.base64

Targets

    • Target

      15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118

    • Size

      120KB

    • MD5

      15f0a22c06c2be78c39e1917e2e798ca

    • SHA1

      7c2c3fe1b56f19376aca59d0cc44fe4614ec4f65

    • SHA256

      b0e40f83154bce1343f616094c5c67fb9991f06aa7a0fb1915f952e40c3d1bba

    • SHA512

      a40175c1bd27a94a417be7487783dd6f36d454bbe353805aa217990410bb664d4f835cce57d3c0fdc65f98be290bab0cd8eed7541793a38be2bec69260b8a3b4

    • SSDEEP

      1536:qurIK51KOzsoK+dtPVpiudZNeLXWB/LnT0MWkbT3y+:3JEL4Xk6Zv3WO3y+

    Score
    10/10
    guloaderdownloaderguloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader payload

      guloader

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks