guloader | 0c0629081a7ea47311f1ee53f047323759f07c3800560282b0ad191ca767b0a9

General

Target
0c0629081a7ea47311f1ee53f047323759f07c3800560282b0ad191ca767b0a9
Size 690KB
Sample240816-h5pbpasblb
SHA256 0c0629081a7ea47311f1ee53f047323759f07c3800560282b0ad191ca767b0a9
MD5 fcea47f1f25c062fd92a247ce57d56c5
SHA1 345fa19dd1237931a5744b9eaea4af33242bdbb4
SHA512 3e06b98deede38370a6154baa72dd3c605a1381622a453aac7e7608e654d78035875f61ca9247b4fc980594ecc60e7abede65626fd89719af16c7284ef3ed551
SSDEEP 12288:WMIOEhV52Uf0QBcfnOGOBulPRDHiFTpL+xgFji2mADjWljI:WMYD0C2OdiD8pL+SjnXGa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  0c0629081a7ea47311f1ee53f047323759f07c3800560282b0ad191ca767b0a9
- Size 690KB
- SHA256 0c0629081a7ea47311f1ee53f047323759f07c3800560282b0ad191ca767b0a9
- MD5 fcea47f1f25c062fd92a247ce57d56c5
- SHA1 345fa19dd1237931a5744b9eaea4af33242bdbb4
- SHA512 3e06b98deede38370a6154baa72dd3c605a1381622a453aac7e7608e654d78035875f61ca9247b4fc980594ecc60e7abede65626fd89719af16c7284ef3ed551
- SSDEEP 12288:WMIOEhV52Uf0QBcfnOGOBulPRDHiFTpL+xgFji2mADjWljI:WMYD0C2OdiD8pL+SjnXGa
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4