guloader | 9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124

Sharing

Copy URL Twitter E-mail

General

Target
MalwareBazaar.6
Size 484KB
Sample240712-k194psyglc
SHA256 9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
MD5 4d5aa2285d7426050f478210bae7c5aa
SHA1 54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
SHA512 e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
SSDEEP 12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  MalwareBazaar.6
- Size 484KB
- SHA256 9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
- MD5 4d5aa2285d7426050f478210bae7c5aa
- SHA1 54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
- SHA512 e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
- SSDEEP 12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader downloader execution persistence
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/BgImage.dll
- Size 7KB
- SHA256 dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b
- MD5 521df745a41f0b8164ffd01717cacbba
- SHA1 dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74
- SHA512 c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe
- SSDEEP 96:8eZ0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk4jnLiEQjJ3KxkP:tXBfjbUA/85q3wEh8uLmVLpmP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0
- MD5 acbda33dd5700c122e2fe48e3d4351fd
- SHA1 2c154baf7c64052ee712b7cdf9c36b7697dd3fc8
- SHA512 d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd
- MD5 SHA1 SHA512
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
- MD5 1c8b2b40c642e8b5a5b3ff102796fb37
- SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
- SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
- SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8