Overview

overview

10

Static

static

1

.vbs

windows7-x64

10

.vbs

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    .vbs

  • Size

    1.2MB

  • Sample

    240902-j9rs2sxbnd

  • MD5

    77ff74408e0e839a58733518b4f5fd65

  • SHA1

    a69bd28eef3b94fcd3f1792141de8f0bc28bae7e

  • SHA256

    bdad372e1916a731f45edde8e2db92eadfb2eda17441fb58963e87002bd4dbbd

  • SHA512

    4a497a1fc7d8180afcb5d81baaf199a8b9710fe7ca5c8cd4256f0337a6a409c5a4d7331c2f18c32ae47899426d2b418f37b6ba653e688b7e01d7e84d38298fcf

  • SSDEEP

    12288:niREMhU7JceNaOBqtVbjoOT3GMQtBzWu5aV0dGh4GwrQH:nihUNHBqfJWMWUo9GsQH

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      .vbs

    • Size

      1.2MB

    • MD5

      77ff74408e0e839a58733518b4f5fd65

    • SHA1

      a69bd28eef3b94fcd3f1792141de8f0bc28bae7e

    • SHA256

      bdad372e1916a731f45edde8e2db92eadfb2eda17441fb58963e87002bd4dbbd

    • SHA512

      4a497a1fc7d8180afcb5d81baaf199a8b9710fe7ca5c8cd4256f0337a6a409c5a4d7331c2f18c32ae47899426d2b418f37b6ba653e688b7e01d7e84d38298fcf

    • SSDEEP

      12288:niREMhU7JceNaOBqtVbjoOT3GMQtBzWu5aV0dGh4GwrQH:nihUNHBqfJWMWUo9GsQH

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks