guloader | e9ac7b75d3fce7318121fd04c86910feffebde6020e7c7965b045d8c1db7a67a

General

Target
e9ac7b75d3fce7318121fd04c86910feffebde6020e7c7965b045d8c1db7a67a.unknown
Size 434KB
Sample240809-b4f6csyamf
SHA256 e9ac7b75d3fce7318121fd04c86910feffebde6020e7c7965b045d8c1db7a67a
MD5 548bb6b836b991e17cc43b896c5cf62f
SHA1 29a1d58e82b038ae4499d146f5d5a5f31325ea4a
SHA512 432ab63a366231c3b3e89f28dfd9244b72c28169cd905480d2672ead08b60eb8db20464489a2dc7605bc8d2c8303220657e481c9cc848c6c321147a86e665553
SSDEEP 12288:TG1mA15zcyckwtPdHh9GIAyq2+2ojf822:Tw3UL6U+2ojf822
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr
- Size 506KB
- SHA256 b81db352466d0a651374b1be399fc2f1b02b638c9a1786a2556d5d7919d2486e
- MD5 e0c9e77759bee166680888c7417a358f
- SHA1 f28e61ee3a03d315962e72e4f9875281f39fc4d6
- SHA512 8fc2324f1040bb52d5ba03d367682a9caae24c769264958822e4efa613183bc3d30940f6b7d3179fc985e80b7ea5a0b0563a16505d64bfa8ad79d22fad9b6523
- SSDEEP 12288:mHadbvM/N20WJ2kva9YffxVTo1AXwcGHswMi1XZ3f88:aadLM/N7WJ2qZV01AFGMwMQU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery guloader collection credential_access downloader spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4