Overview

overview

10

Static

static

3

b0ae0b6594...18.exe

windows7-x64

10

b0ae0b6594...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0ae0b6594e872428a8782911dad0c84_JaffaCakes118

  • Size

    36KB

  • Sample

    240615-3hyxtszajg

  • MD5

    b0ae0b6594e872428a8782911dad0c84

  • SHA1

    334ae0967b40c43d1a7496007185bc09205442f0

  • SHA256

    721c885321d1c1bde1fc7dec431bdbc2850815bfcaf6b34e8c106f0d381f8498

  • SHA512

    1f1cc155c77d07e9a20d6dc6383ec8902af7e6c99eeb81109bdf7d134503d3415b21bf0ad1a237777c1f4b0843d76186efbdc7bd0b37d8eba478c204cdd87acf

  • SSDEEP

    768:gusI1m/D/QeZcGTcl09y/ZwiiEh7wkV8VP:7sqmrXzcl09y/vh7wU8VP

Score
10/10
guloaderdownloader

Malware Config

Extracted

Family

guloader

C2

http://castmart.ga/~zadmin/ecloud/nklo_encrypted_3668BE0.bin

xor.base64

Targets

    • Target

      b0ae0b6594e872428a8782911dad0c84_JaffaCakes118

    • Size

      36KB

    • MD5

      b0ae0b6594e872428a8782911dad0c84

    • SHA1

      334ae0967b40c43d1a7496007185bc09205442f0

    • SHA256

      721c885321d1c1bde1fc7dec431bdbc2850815bfcaf6b34e8c106f0d381f8498

    • SHA512

      1f1cc155c77d07e9a20d6dc6383ec8902af7e6c99eeb81109bdf7d134503d3415b21bf0ad1a237777c1f4b0843d76186efbdc7bd0b37d8eba478c204cdd87acf

    • SSDEEP

      768:gusI1m/D/QeZcGTcl09y/ZwiiEh7wkV8VP:7sqmrXzcl09y/vh7wU8VP

    Score
    10/10
    guloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks