guloader | de52002c9566018c61b816f862325c681c756758e693c9d40b70670caf22a2c4

General

Target
de52002c9566018c61b816f862325c681c756758e693c9d40b70670caf22a2c4.rar
Size 242KB
Sample240627-b43dlayflr
SHA256 de52002c9566018c61b816f862325c681c756758e693c9d40b70670caf22a2c4
MD5 905ea903cc9cccce0c3a3e4eaa699f66
SHA1 69d1b7740f9c968215fb44c20a02759d2ee9f7d2
SHA512 22e8fb03c0aee000567f353a9eba70e59c01faa1f19fe4d93ebd5cccafdb25aec52aa4661cd5ad8d85737521aecab93878943e630be19d7f0d8e718343346620
SSDEEP 6144:LipIgTrTl/jSXwn251cdEWzNIhMlgSpy5L3yAur/aolLm02:LOVTl/jSBONT3pyxCRLLR2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  SMKT_COPY20240604.exe
- Size 314KB
- SHA256 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86
- MD5 c7ceecb921d43912ec928af816a43ede
- SHA1 2c4266ebdae98fc609ffb191cf26e85dc0671faa
- SHA512 8b4ecfc89221af3d4dde2ab7effc288f9c9ddaba764b67acbde33fbc5c19d69e16d69c40f35de74e36f4eb12bdd2ffba44b702bea9d5249476dafc7f4f389e31
- SSDEEP 6144:BXFKo5F4CtVeI8Y9BA6MA4ph2LN7LNNhEdMUjzz4elzC:BX54CVeI8Y9BA6uph2LN7LNNhTelO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader collection downloader persistence spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
- MD5 b4579bc396ace8cafd9e825ff63fe244
- SHA1 32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
- SHA512 3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
- SSDEEP 96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6