guloader | 73fbcba5b46a4335d5baa96f30210fb1aae96faf0c5ef80b5254b3bdaba922da

General

Target
Scries.exe
Size 488KB
Sample240508-swbdksde46
SHA256 73fbcba5b46a4335d5baa96f30210fb1aae96faf0c5ef80b5254b3bdaba922da
MD5 fa01289d36b091d3d9866e2cc4a4d386
SHA1 89e5223ecdef2312f7af86c0b68f57f9888d2e67
SHA512 7685f3c80de16fa95c52d115d2fa918db4f88577adbeacd8d1ecf4aab132c5c96f1391094b665115bb2f903dcc1a28c595709433fae25c1cf944ed01ca38def5
SSDEEP 12288:SkBMrvb8eb8SojLis5RB0QcIhSjohfSq11j82nt:FBMrQeyJRBBucBj8c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Targets

- Target
  Scries.exe
- Size 488KB
- SHA256 73fbcba5b46a4335d5baa96f30210fb1aae96faf0c5ef80b5254b3bdaba922da
- MD5 fa01289d36b091d3d9866e2cc4a4d386
- SHA1 89e5223ecdef2312f7af86c0b68f57f9888d2e67
- SHA512 7685f3c80de16fa95c52d115d2fa918db4f88577adbeacd8d1ecf4aab132c5c96f1391094b665115bb2f903dcc1a28c595709433fae25c1cf944ed01ca38def5
- SSDEEP 12288:SkBMrvb8eb8SojLis5RB0QcIhSjohfSq11j82nt:FBMrQeyJRBBucBj8c
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4