guloader | 36c2f4c0313fac3e054c832436887b376c4d5b19312a64b4d8751add5a32ead7

General

Target
36c2f4c0313fac3e054c832436887b376c4d5b19312a64b4d8751add5a32ead7
Size 406KB
Sample240809-fl86msxaqr
SHA256 36c2f4c0313fac3e054c832436887b376c4d5b19312a64b4d8751add5a32ead7
MD5 7374feae9dbf10a24102b2c3f9dab9be
SHA1 a095a19d9624d998bd0f4286da68196b7498607f
SHA512 e236782eadcec54ac1f9f10fcdcfd8eedbdd9404b9f82eea4e75b82505d7aeff21eb390ecd95b6880a9c2f3472d50b5ce2aa5e3bdefb602914d78755a36f5a9d
SSDEEP 6144:3qjIMMwjbAudZg8hqKHXffx2ABryLl45R2Do3xcRArpsIgii8MazvVhH:SwmbAqg8vHEABryhc2D8SAm8BvVhH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  36c2f4c0313fac3e054c832436887b376c4d5b19312a64b4d8751add5a32ead7
- Size 406KB
- SHA256 36c2f4c0313fac3e054c832436887b376c4d5b19312a64b4d8751add5a32ead7
- MD5 7374feae9dbf10a24102b2c3f9dab9be
- SHA1 a095a19d9624d998bd0f4286da68196b7498607f
- SHA512 e236782eadcec54ac1f9f10fcdcfd8eedbdd9404b9f82eea4e75b82505d7aeff21eb390ecd95b6880a9c2f3472d50b5ce2aa5e3bdefb602914d78755a36f5a9d
- SSDEEP 6144:3qjIMMwjbAudZg8hqKHXffx2ABryLl45R2Do3xcRArpsIgii8MazvVhH:SwmbAqg8vHEABryhc2D8SAm8BvVhH
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
- MD5 34442e1e0c2870341df55e1b7b3cccdc
- SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
- SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
- SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 3aa8e0abadefea2de58281198acfe48713a1d5b43aea5619f563cea098e9fd34
- MD5 ac0f93b2dec82e9579bff14c8572a6c8
- SHA1 6460244317cbb77e342adb3561ec3acb496c84d5
- SHA512 8055a6af150c45547927499f9cbf645d7f39c8e4f9caff4726fd711d2401abca01a79837095e5752b9f57b06446973ea6506796f2223bdb0179243d6e0575bd2
- SSDEEP 96:5OBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+u3wEX:5hB2flXAVJtjf6cBbcB/N8Ved0PJ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6