guloader | 29b4fb29e554f7742c65631632008d3dc162411ee22552fe75e386bc174af3d7

General

Target
BenefitsRequest#241305.com.exe
Size 563KB
Sample240514-hpsdeaef96
SHA256 29b4fb29e554f7742c65631632008d3dc162411ee22552fe75e386bc174af3d7
MD5 7ec58d2a993aa1b84ac13ac8b79533c3
SHA1 31b010160a16152ae34d9723da1562b54c858e2f
SHA512 46d8fe0ef416e4f6266e84e8a8b3fdb20ba820a98df16f7740580297c13df64bafb323a1f5ef4fce59e0743cdfd7302cf1df2afc6c5670ae2f471cdebd0bd64b
SSDEEP 12288:QMw/qS1ZEDK6eS5Z/O51Itwg2XiOQjKv0+PNKgk5Slw9:QMw/qogWSwItwViOQev0tl5Slw9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  BenefitsRequest#241305.com.exe
- Size 563KB
- SHA256 29b4fb29e554f7742c65631632008d3dc162411ee22552fe75e386bc174af3d7
- MD5 7ec58d2a993aa1b84ac13ac8b79533c3
- SHA1 31b010160a16152ae34d9723da1562b54c858e2f
- SHA512 46d8fe0ef416e4f6266e84e8a8b3fdb20ba820a98df16f7740580297c13df64bafb323a1f5ef4fce59e0743cdfd7302cf1df2afc6c5670ae2f471cdebd0bd64b
- SSDEEP 12288:QMw/qS1ZEDK6eS5Z/O51Itwg2XiOQjKv0+PNKgk5Slw9:QMw/qogWSwItwViOQev0tl5Slw9
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader collection downloader execution
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Command and Scripting Interpreter: PowerShell

Accesses Microsoft Outlook accounts

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2