Overview

overview

10

Static

static

3

CEMENTOS-DOC.exe

windows7-x64

10

CEMENTOS-DOC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    44606c062b149f83d21924f606e201fd_JaffaCakes118
  • Size 19KB
  • Sample240729-nwl3vsxapm
  • SHA256 c8e41c717befab77f5b7a3641bc1f6c0832f9f8e80d30873be1a888e5bfaf7a8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
guloaderdiscoverydownloader

Malware Config

Extracted

Family

  • guloader

C2

  • https://drive.google.com/uc?export=download&id=1LmyqIluFJ5HoNT0VjWSvtPFmVfK-cvxy

xor.base64

Targets

    • Target
      CEMENTOS-DOC.exe
    • Size 60KB
    • SHA256 994655b2cfd0979f7b96ae1f4423510633a82adf92fa6486dfd2f3243e96618d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks