guloader | 9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124

Sharing

Copy URL

Twitter E-mail

General

Target

MalwareBazaar.6
Size

484KB
Sample

240712-k194psyglc
MD5

4d5aa2285d7426050f478210bae7c5aa
SHA1

54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
SHA256

9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
SHA512

e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
SSDEEP

12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD

Score

10^/10

Malware Config

Targets

- Target
  
  MalwareBazaar.6
- Size
  
  484KB
- MD5
  
  4d5aa2285d7426050f478210bae7c5aa
- SHA1
  
  54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
- SHA256
  
  9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
- SHA512
  
  e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
- SSDEEP
  
  12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD
Score

10^/10

guloader downloader execution persistence
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BgImage.dll
- Size
  
  7KB
- MD5
  
  521df745a41f0b8164ffd01717cacbba
- SHA1
  
  dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74
- SHA256
  
  dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b
- SHA512
  
  c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe
- SSDEEP
  
  96:8eZ0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk4jnLiEQjJ3KxkP:tXBfjbUA/85q3wEh8uLmVLpmP
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/UserInfo.dll
- Size
  
  4KB
- MD5
  
  acbda33dd5700c122e2fe48e3d4351fd
- SHA1
  
  2c154baf7c64052ee712b7cdf9c36b7697dd3fc8
- SHA256
  
  943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0
- SHA512
  
  d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  1c8b2b40c642e8b5a5b3ff102796fb37
- SHA1
  
  3245f55afac50f775eb53fd6d14abb7fe523393d
- SHA256
  
  8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
- SHA512
  
  4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
- SSDEEP
  
  96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
Score

3^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8