Overview

overview

10

Static

static

3

5828d4217d...8d.exe

windows7-x64

7

5828d4217d...8d.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Unbegrudge...hr.app

macos-10.15-amd64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

  • Size

    318KB

  • Sample

    240523-bw9spsgf61

  • MD5

    46e978f5dee2d39687269d77e44df3cf

  • SHA1

    f15c27a41a2e7e78b07df29c687da3e70e813e66

  • SHA256

    5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

  • SHA512

    81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19

  • SSDEEP

    6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

Score
10/10
guloaderdownloadermacos

Malware Config

Targets

    • Target

      5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

    • Size

      318KB

    • MD5

      46e978f5dee2d39687269d77e44df3cf

    • SHA1

      f15c27a41a2e7e78b07df29c687da3e70e813e66

    • SHA256

      5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

    • SHA512

      81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19

    • SSDEEP

      6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

    Score
    10/10
    guloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    • SHA1

      7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    • SHA256

      d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    • SHA512

      cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

    • SSDEEP

      192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      035bdb470a6807313bd005bd98341ffc

    • SHA1

      5017d1e5a23f1c64594f737e6fccd519729c3b3e

    • SHA256

      26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

    • SHA512

      f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      eb2c74e05b30b29887b3219f4ea3fdab

    • SHA1

      91173d46b34e7bae57acabdbd239111b5bcc4d9e

    • SHA256

      d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

    • SHA512

      1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

    • SSDEEP

      96:oVDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx488qndYv0PLE:oVp34z/x3sREskpxjdO0PLE

    Score
    3/10
    behavioral7behavioral8

    • Target

      Unbegrudged/retouchr.app

    • Size

      4KB

    • MD5

      78c3f9caadc9005059318c41af371f53

    • SHA1

      47427be3d4d5c20b10ebe761d44fc3c6dd82b92f

    • SHA256

      38da1491f6996d1bd6c41949bb0ee04431d1f26991849be89b3a4fae488b76b1

    • SHA512

      250acfc789595818403a27198c930a3dbe006336de9dec2c8c1e097c575d8cd1e2960a5b163975324fdc24b5cc9ce251fa28505cae48a1fe8a9676bc17906120

    • SSDEEP

      96:2JZjKAUt4rE5yHGP/tmB4/cLodXL6FYYVtiCOfKRjY:iZjKAUt4Mh0CkenYQCRjY

    Score
    1/10
    behavioral9

MITRE ATT&CK Enterprise v15

Tasks