guloader | 8317fc4b7eb8d40478a79de9fc539469ab5b2904822894ac6eee27f7cf9e6ce9

Resubmissions

13/09/2024, 07:40 UTC

240913-jhhq3a1hjq 8

13/09/2024, 07:26 UTC

240913-h9trza1ekr 8

09/09/2024, 06:56 UTC

240909-hqwgfsyeka 10

Sharing

Copy URL

Twitter E-mail

General

Target

pko_trans_details_20240909_105339·pdf.vbs
Size

34KB
Sample

240909-hqwgfsyeka
MD5

f47be72a96dd07190c9636231654dfe5
SHA1

b0f23fa8a4669111d04e442e81888330f76b5689
SHA256

8317fc4b7eb8d40478a79de9fc539469ab5b2904822894ac6eee27f7cf9e6ce9
SHA512

a739b342622f6949f3238b18b8c51ecbddfa61ddd6d2b18b83bff9f9b72a9c9774aca871f547ace1d41a123d756e3498babd6eb42d9b4e42f3c32e2ec91bdc56
SSDEEP

192:oM+q8B50G4urQDIN9+H27uci5akloQROGHb0m1f8uk2R6Ct9gpCIHOmJTmFLauQ:l8Lv4urQ89mAu9YzafAGk2RnyYBPTQ

Score

10^/10

Malware Config

Targets

- Target
  
  pko_trans_details_20240909_105339·pdf.vbs
- Size
  
  34KB
- MD5
  
  f47be72a96dd07190c9636231654dfe5
- SHA1
  
  b0f23fa8a4669111d04e442e81888330f76b5689
- SHA256
  
  8317fc4b7eb8d40478a79de9fc539469ab5b2904822894ac6eee27f7cf9e6ce9
- SHA512
  
  a739b342622f6949f3238b18b8c51ecbddfa61ddd6d2b18b83bff9f9b72a9c9774aca871f547ace1d41a123d756e3498babd6eb42d9b4e42f3c32e2ec91bdc56
- SSDEEP
  
  192:oM+q8B50G4urQDIN9+H27uci5akloQROGHb0m1f8uk2R6Ct9gpCIHOmJTmFLauQ:l8Lv4urQ89mAu9YzafAGk2RnyYBPTQ
Score

10^/10

guloader discovery downloader execution
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Blocklisted process makes network request

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.