Overview

overview

10

Static

static

3

8a55b9f965...18.exe

windows7-x64

10

8a55b9f965...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8a55b9f965179c553dfb934e8e0edf37_JaffaCakes118
  • Size 40KB
  • Sample240811-phv92stcjd
  • SHA256 1de207f795f29dbb550f6a90674a8ba12b35ffcade3a37e7b942a6659ae6835a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
guloaderdiscoverydownloader

Malware Config

Extracted

Family

  • guloader

C2

  • https://onedrive.live.com/download?cid=4C3F5C65A99DA195&resid=4C3F5C65A99DA195%21218&authkey=AM8ss7HCvsrocgc

xor.base64

Targets

    • Target
      8a55b9f965179c553dfb934e8e0edf37_JaffaCakes118
    • Size 40KB
    • SHA256 1de207f795f29dbb550f6a90674a8ba12b35ffcade3a37e7b942a6659ae6835a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks