guloader | 24798751df33c8a9a5e2173e2f26c5ad51bc95dec30cc7791abc8deffc751c24

Resubmissions

31/07/2024, 12:45

240731-py8v3stemp10

31/07/2024, 12:41

240731-pxalwstdmr10

Sharing

Copy URL Twitter E-mail

General

Target
KSI RFQ-20240732AB.tgz
Size 418KB
Sample240731-py8v3stemp
SHA256 24798751df33c8a9a5e2173e2f26c5ad51bc95dec30cc7791abc8deffc751c24
MD5 d7dfb721283050cf44fd3617019d8143
SHA1 24679e7acf0fae88e7e65f3a2d7fae2fcf26d958
SHA512 9458c8ad7d4912c7ac0f46e59e7a5d6dd2259cd8bc77b0a0586b5f99153a2555911706cd2f0d635c6f495026efd41c7be30d5b18c7ff03cc8233cf742450a3eb
SSDEEP 12288:VuhBqsd6boC+fIR0naMkFldbQ7ZKPzISby+oY:SBf4l+E0nwqZszuY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  KSI RFQ-20240732AB.exe
- Size 509KB
- SHA256 e26a2e19e50d80e946bc61c92fe1fcfa53572bfc5494289d36d9126143d92663
- MD5 8219db83bdd90d0a123efdf6800f2050
- SHA1 454c190f0635ff504a83d459e0034ebdf877b63d
- SHA512 b539215e3c7d4d5c62e68c05d76dd4bace557fc3185f7a149a2a5ae90698b036f0b78f0f2d9e622e806ec358d81107fc2b7ccffd329905133adfd605882d1fd3
- SSDEEP 6144:OPXmDTGDND3MmPNRv8+lmrKyARexVib4bZmGuqMqtEmCMAruHvg8R02kA7WtrAA6:nDS180TAAReWJ1qMGY4nR/foncEgke9
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4