guloader | 7fb76cbc560551518f1ed1c77b4e930b6faff77f63815f0090712eb644d87fe0

General

Target
IMG_0000053Legal_warning_Invoices.exe
Size 743KB
Sample240826-taaetstbpp
SHA256 7fb76cbc560551518f1ed1c77b4e930b6faff77f63815f0090712eb644d87fe0
MD5 70836ea62c86701beea228207ebbe690
SHA1 16aa45a1149f7ac44bfacf029d338a67e26501ff
SHA512 d7fefb5729b6ebcf66fd4339232d43bb7d430255e3bd73cfc0af5edd2030d7744d3ecd51ddc94710ebc18e29bbf30e0af79281d07ca7ee8e1bfb614cd11d1f28
SSDEEP 12288:9I0Ygl+4LU7HJx5q7vMw/hCIToWURuDnEF9jyY2eAuVLZEqhaH/e5ofi:9I0blDAdeIJVAg48AuVLZEkIfi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  IMG_0000053Legal_warning_Invoices.exe
- Size 743KB
- SHA256 7fb76cbc560551518f1ed1c77b4e930b6faff77f63815f0090712eb644d87fe0
- MD5 70836ea62c86701beea228207ebbe690
- SHA1 16aa45a1149f7ac44bfacf029d338a67e26501ff
- SHA512 d7fefb5729b6ebcf66fd4339232d43bb7d430255e3bd73cfc0af5edd2030d7744d3ecd51ddc94710ebc18e29bbf30e0af79281d07ca7ee8e1bfb614cd11d1f28
- SSDEEP 12288:9I0Ygl+4LU7HJx5q7vMw/hCIToWURuDnEF9jyY2eAuVLZEqhaH/e5ofi:9I0blDAdeIJVAg48AuVLZEkIfi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 982954ea90a10844bff23d595ac2449c6fae300aee2ab4c23077aac1197b7c2e
- MD5 c5351b7c9aa48e9e7872288a3e7dd583
- SHA1 69efcf341345625a4a855f03f2a9d9e8f50319b2
- SHA512 6e655e02aa05bc52beec428686622c4c1c1ffc7e5aba0f6d429495cba29bee5733b26ac7aecbeaa9e525eae52706a2513035d17cc7b0ccbcf792c765c9427d7b
- SSDEEP 48:SFPPhYdei1W0Moh82rI7+S2QWviyviU1qeePWfhfof3mkV:+BFi1e12rI7+TvpQeh
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55
- MD5 c61501f07cf09bcfcdfe4cc8a1ebbbe3
- SHA1 e8581b4359651b857646ae727efaaef372daa0fc
- SHA512 9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24
- SSDEEP 192:Kk09rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:Kk0JQEaVAK7R9SfpjpQYLRszfH/d9CWv
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6