guloader | c7a6d57fc3d397c2b303477d8e1d4fea64fec51f46b0ddfad97a11527771702c

General

Target
Ziraat Bankasi Swift Mesaji.exe
Size 853KB
Sample240702-glbe2ssglm
SHA256 c7a6d57fc3d397c2b303477d8e1d4fea64fec51f46b0ddfad97a11527771702c
MD5 57dbc2be60ede5140738c720a629781c
SHA1 b348e314c3f9be312725b23a0fecf491404caf66
SHA512 8932c191f72eb089d346848164c36104e6114e39cdeed19d1e67a7546ce68f01d8fdadec2c6f9ce5a80915e5781631fd37018f9e57c3a1d54d677f2e9c6ae006
SSDEEP 24576:N3mYVFbTdL3LgGStF2C/GVOoD5jQZj7/MJhmO:N3mYV9x3SH2C/EOEm7lO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Targets

- Target
  Ziraat Bankasi Swift Mesaji.exe
- Size 853KB
- SHA256 c7a6d57fc3d397c2b303477d8e1d4fea64fec51f46b0ddfad97a11527771702c
- MD5 57dbc2be60ede5140738c720a629781c
- SHA1 b348e314c3f9be312725b23a0fecf491404caf66
- SHA512 8932c191f72eb089d346848164c36104e6114e39cdeed19d1e67a7546ce68f01d8fdadec2c6f9ce5a80915e5781631fd37018f9e57c3a1d54d677f2e9c6ae006
- SSDEEP 24576:N3mYVFbTdL3LgGStF2C/GVOoD5jQZj7/MJhmO:N3mYV9x3SH2C/EOEm7lO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  Nicaean/Gangbrdderne86.doc
- Size 301KB
- SHA256 6178d1b0de66ef523b5ce188bb92eb9651ff99383a0ed1e1b9b2cd69f651c45e
- MD5 f2060b3940c55ff4023d4340598f4aa9
- SHA1 a7ee53054c21ab1b6082db2732e1973a98ac5149
- SHA512 9b212142cde23a426b51d151547a73b9a5ba04081c354d8f0c5b8cbce9ec359db53aa2a4677a59532b83d06baa65127391b82816ef02a70b8a1f8e4f2aa84462
- SSDEEP 384:m6srPhzGmc17ehfBtdbowZFBhBLnHIaQjcNWmBsuJYMxsZlRfaWC6uLg1x0S68Jz:OPhOWhtZIXEvJYjRfa+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6