guloader | b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5

Sharing

Copy URL Twitter E-mail

General

Target
b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
Size 322KB
Sample240523-sd5jpsfb5y
SHA256 b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5
MD5 86a0fbc943d577f93faf00394997bb22
SHA1 bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3
SHA512 c047b8a78a8513fa37a4147d45dfe92c3534693ab5394ee96d50090d71cd28097da09b409e4d00c0e5d6ef1451d29119156c80bd227d7eb5172ea8c7c3713c72
SSDEEP 6144:A9X0GAbjQDWloo891UylPBX6xuY6RzWBw39tASqEHSVI9AWKw133:G0t/looK1UABXTUI9/Kw133
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
- Size 322KB
- SHA256 b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5
- MD5 86a0fbc943d577f93faf00394997bb22
- SHA1 bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3
- SHA512 c047b8a78a8513fa37a4147d45dfe92c3534693ab5394ee96d50090d71cd28097da09b409e4d00c0e5d6ef1451d29119156c80bd227d7eb5172ea8c7c3713c72
- SSDEEP 6144:A9X0GAbjQDWloo891UylPBX6xuY6RzWBw39tASqEHSVI9AWKw133:G0t/looK1UABXTUI9/Kw133
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
- MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
- SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
- SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
- SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27
- MD5 035bdb470a6807313bd005bd98341ffc
- SHA1 5017d1e5a23f1c64594f737e6fccd519729c3b3e
- SHA512 f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05
- MD5 SHA1 SHA512
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed
- MD5 eb2c74e05b30b29887b3219f4ea3fdab
- SHA1 91173d46b34e7bae57acabdbd239111b5bcc4d9e
- SHA512 1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae
- SSDEEP 96:oVDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx488qndYv0PLE:oVp34z/x3sREskpxjdO0PLE
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  Spadestrens/retouchr.app
- Size 4KB
- SHA256 38da1491f6996d1bd6c41949bb0ee04431d1f26991849be89b3a4fae488b76b1
- MD5 78c3f9caadc9005059318c41af371f53
- SHA1 47427be3d4d5c20b10ebe761d44fc3c6dd82b92f
- SHA512 250acfc789595818403a27198c930a3dbe006336de9dec2c8c1e097c575d8cd1e2960a5b163975324fdc24b5cc9ce251fa28505cae48a1fe8a9676bc17906120
- SSDEEP 96:2JZjKAUt4rE5yHGP/tmB4/cLodXL6FYYVtiCOfKRjY:iZjKAUt4Mh0CkenYQCRjY
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

evasion
behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9