guloader | 24798751df33c8a9a5e2173e2f26c5ad51bc95dec30cc7791abc8deffc751c24

General

Target
KSI RFQ-20240732AB.tgz
Size 418KB
Sample240731-pxalwstdmr
SHA256 24798751df33c8a9a5e2173e2f26c5ad51bc95dec30cc7791abc8deffc751c24
MD5 d7dfb721283050cf44fd3617019d8143
SHA1 24679e7acf0fae88e7e65f3a2d7fae2fcf26d958
SHA512 9458c8ad7d4912c7ac0f46e59e7a5d6dd2259cd8bc77b0a0586b5f99153a2555911706cd2f0d635c6f495026efd41c7be30d5b18c7ff03cc8233cf742450a3eb
SSDEEP 12288:VuhBqsd6boC+fIR0naMkFldbQ7ZKPzISby+oY:SBf4l+E0nwqZszuY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  KSI RFQ-20240732AB.exe
- Size 509KB
- SHA256 e26a2e19e50d80e946bc61c92fe1fcfa53572bfc5494289d36d9126143d92663
- MD5 8219db83bdd90d0a123efdf6800f2050
- SHA1 454c190f0635ff504a83d459e0034ebdf877b63d
- SHA512 b539215e3c7d4d5c62e68c05d76dd4bace557fc3185f7a149a2a5ae90698b036f0b78f0f2d9e622e806ec358d81107fc2b7ccffd329905133adfd605882d1fd3
- SSDEEP 6144:OPXmDTGDND3MmPNRv8+lmrKyARexVib4bZmGuqMqtEmCMAruHvg8R02kA7WtrAA6:nDS180TAAReWJ1qMGY4nR/foncEgke9
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
- MD5 09c2e27c626d6f33018b8a34d3d98cb6
- SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
- SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
- SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6