guloader | b81db352466d0a651374b1be399fc2f1b02b638c9a1786a2556d5d7919d2486e

General

Target
b81db352466d0a651374b1be399fc2f1b02b638c9a1786a2556d5d7919d2486e.exe
Size 506KB
Sample240809-byz2aavajr
SHA256 b81db352466d0a651374b1be399fc2f1b02b638c9a1786a2556d5d7919d2486e
MD5 e0c9e77759bee166680888c7417a358f
SHA1 f28e61ee3a03d315962e72e4f9875281f39fc4d6
SHA512 8fc2324f1040bb52d5ba03d367682a9caae24c769264958822e4efa613183bc3d30940f6b7d3179fc985e80b7ea5a0b0563a16505d64bfa8ad79d22fad9b6523
SSDEEP 12288:mHadbvM/N20WJ2kva9YffxVTo1AXwcGHswMi1XZ3f88:aadLM/N7WJ2qZV01AFGMwMQU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b81db352466d0a651374b1be399fc2f1b02b638c9a1786a2556d5d7919d2486e.exe
- Size 506KB
- SHA256 b81db352466d0a651374b1be399fc2f1b02b638c9a1786a2556d5d7919d2486e
- MD5 e0c9e77759bee166680888c7417a358f
- SHA1 f28e61ee3a03d315962e72e4f9875281f39fc4d6
- SHA512 8fc2324f1040bb52d5ba03d367682a9caae24c769264958822e4efa613183bc3d30940f6b7d3179fc985e80b7ea5a0b0563a16505d64bfa8ad79d22fad9b6523
- SSDEEP 12288:mHadbvM/N20WJ2kva9YffxVTo1AXwcGHswMi1XZ3f88:aadLM/N7WJ2qZV01AFGMwMQU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery guloader collection credential_access downloader spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4