guloader | a1f60afcf5d8ef739f2d547be2c8ce526c2aaccfaf1983f2e6a955ec6379affd

General

Target
a1f60afcf5d8ef739f2d547be2c8ce526c2aaccfaf1983f2e6a955ec6379affd.exe
Size 1.2MB
Sample240814-qf72hatfme
SHA256 a1f60afcf5d8ef739f2d547be2c8ce526c2aaccfaf1983f2e6a955ec6379affd
MD5 45bf52f78adb38d4a8aab2b184c34eda
SHA1 091517c4f25749ec11cbc04a1436455231b3bedf
SHA512 8087b81b07079d2fc5bce600359207ce4db4f27c092abf306b2ea1e63beac52f74455bfc39df57c5f169d9fdb8ea194cfcbb97c7c09eb68edc5bffd9f1890399
SSDEEP 24576:1mASOcxHPL8Dm8Ax6KO+ZPwHs6mxSFrJ7nEZoina+q+D:1mJrLQQxzPWZtr5EfnaX+D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  a1f60afcf5d8ef739f2d547be2c8ce526c2aaccfaf1983f2e6a955ec6379affd.exe
- Size 1.2MB
- SHA256 a1f60afcf5d8ef739f2d547be2c8ce526c2aaccfaf1983f2e6a955ec6379affd
- MD5 45bf52f78adb38d4a8aab2b184c34eda
- SHA1 091517c4f25749ec11cbc04a1436455231b3bedf
- SHA512 8087b81b07079d2fc5bce600359207ce4db4f27c092abf306b2ea1e63beac52f74455bfc39df57c5f169d9fdb8ea194cfcbb97c7c09eb68edc5bffd9f1890399
- SSDEEP 24576:1mASOcxHPL8Dm8Ax6KO+ZPwHs6mxSFrJ7nEZoina+q+D:1mJrLQQxzPWZtr5EfnaX+D
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader collection credential_access spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4