Overview

overview

10

Static

static

3

b4834413f9...b5.exe

windows7-x64

7

b4834413f9...b5.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Spadestren...hr.app

macos-10.15-amd64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

  • Size

    322KB

  • Sample

    240523-cctstahg34

  • MD5

    86a0fbc943d577f93faf00394997bb22

  • SHA1

    bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3

  • SHA256

    b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5

  • SHA512

    c047b8a78a8513fa37a4147d45dfe92c3534693ab5394ee96d50090d71cd28097da09b409e4d00c0e5d6ef1451d29119156c80bd227d7eb5172ea8c7c3713c72

  • SSDEEP

    6144:A9X0GAbjQDWloo891UylPBX6xuY6RzWBw39tASqEHSVI9AWKw133:G0t/looK1UABXTUI9/Kw133

Score
10/10
guloaderdownloadermacos

Malware Config

Targets

    • Target

      b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

    • Size

      322KB

    • MD5

      86a0fbc943d577f93faf00394997bb22

    • SHA1

      bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3

    • SHA256

      b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5

    • SHA512

      c047b8a78a8513fa37a4147d45dfe92c3534693ab5394ee96d50090d71cd28097da09b409e4d00c0e5d6ef1451d29119156c80bd227d7eb5172ea8c7c3713c72

    • SSDEEP

      6144:A9X0GAbjQDWloo891UylPBX6xuY6RzWBw39tASqEHSVI9AWKw133:G0t/looK1UABXTUI9/Kw133

    Score
    10/10
    guloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    • SHA1

      7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    • SHA256

      d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    • SHA512

      cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

    • SSDEEP

      192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      035bdb470a6807313bd005bd98341ffc

    • SHA1

      5017d1e5a23f1c64594f737e6fccd519729c3b3e

    • SHA256

      26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

    • SHA512

      f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      eb2c74e05b30b29887b3219f4ea3fdab

    • SHA1

      91173d46b34e7bae57acabdbd239111b5bcc4d9e

    • SHA256

      d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

    • SHA512

      1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

    • SSDEEP

      96:oVDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx488qndYv0PLE:oVp34z/x3sREskpxjdO0PLE

    Score
    3/10
    behavioral7behavioral8

    • Target

      Spadestrens/retouchr.app

    • Size

      4KB

    • MD5

      78c3f9caadc9005059318c41af371f53

    • SHA1

      47427be3d4d5c20b10ebe761d44fc3c6dd82b92f

    • SHA256

      38da1491f6996d1bd6c41949bb0ee04431d1f26991849be89b3a4fae488b76b1

    • SHA512

      250acfc789595818403a27198c930a3dbe006336de9dec2c8c1e097c575d8cd1e2960a5b163975324fdc24b5cc9ce251fa28505cae48a1fe8a9676bc17906120

    • SSDEEP

      96:2JZjKAUt4rE5yHGP/tmB4/cLodXL6FYYVtiCOfKRjY:iZjKAUt4Mh0CkenYQCRjY

    Score
    1/10
    behavioral9

MITRE ATT&CK Matrix ATT&CK v13

Tasks