guloader | 952e53e74c1bb7329959c54edaa6282aaa112e0332563c0fc3f6a8cc150c0119

General

Target
SCAN00381638.SCR.exe
Size 324KB
Sample240618-sj1spsyfla
SHA256 952e53e74c1bb7329959c54edaa6282aaa112e0332563c0fc3f6a8cc150c0119
MD5 867e4bb469090bb49c273ac720f9f4b4
SHA1 84c50442581782a0a69ab8374ac32e1914cd0a77
SHA512 becfc2d2aa5887106a0b52372e5db354616b6f6441768104ed30b039a138ae6ab74645a5fb8b7802f077ff05c19f5fe25c13e7d9878a0a7a94e6d967ddd42f5c
SSDEEP 6144:OXFKo5F4CtVeI8YJ+kYg/3MUtMQA+LlcVR4el7g43:OX54CVeI8Y8kb/cAMQA+hcVR4elR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  SCAN00381638.SCR.exe
- Size 324KB
- SHA256 952e53e74c1bb7329959c54edaa6282aaa112e0332563c0fc3f6a8cc150c0119
- MD5 867e4bb469090bb49c273ac720f9f4b4
- SHA1 84c50442581782a0a69ab8374ac32e1914cd0a77
- SHA512 becfc2d2aa5887106a0b52372e5db354616b6f6441768104ed30b039a138ae6ab74645a5fb8b7802f077ff05c19f5fe25c13e7d9878a0a7a94e6d967ddd42f5c
- SSDEEP 6144:OXFKo5F4CtVeI8YJ+kYg/3MUtMQA+LlcVR4el7g43:OX54CVeI8Y8kb/cAMQA+hcVR4elR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader collection downloader persistence spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
- MD5 b4579bc396ace8cafd9e825ff63fe244
- SHA1 32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
- SHA512 3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
- SSDEEP 96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6