Overview

overview

10

Static

static

1

pko_trans_...df.vbs

windows7-x64

10

pko_trans_...df.vbs

windows10-2004-x64

10

Resubmissions

13-09-2024 07:40

240913-jhhq3a1hjq 8

13-09-2024 07:26

240913-h9trza1ekr 8

09-09-2024 06:56

240909-hqwgfsyeka 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pko_trans_details_20240909_105339·pdf.vbs

  • Size

    34KB

  • Sample

    240909-hqwgfsyeka

  • MD5

    f47be72a96dd07190c9636231654dfe5

  • SHA1

    b0f23fa8a4669111d04e442e81888330f76b5689

  • SHA256

    8317fc4b7eb8d40478a79de9fc539469ab5b2904822894ac6eee27f7cf9e6ce9

  • SHA512

    a739b342622f6949f3238b18b8c51ecbddfa61ddd6d2b18b83bff9f9b72a9c9774aca871f547ace1d41a123d756e3498babd6eb42d9b4e42f3c32e2ec91bdc56

  • SSDEEP

    192:oM+q8B50G4urQDIN9+H27uci5akloQROGHb0m1f8uk2R6Ct9gpCIHOmJTmFLauQ:l8Lv4urQ89mAu9YzafAGk2RnyYBPTQ

Score
10/10
guloaderdiscoverydownloaderexecution

Malware Config

Targets

    • Target

      pko_trans_details_20240909_105339·pdf.vbs

    • Size

      34KB

    • MD5

      f47be72a96dd07190c9636231654dfe5

    • SHA1

      b0f23fa8a4669111d04e442e81888330f76b5689

    • SHA256

      8317fc4b7eb8d40478a79de9fc539469ab5b2904822894ac6eee27f7cf9e6ce9

    • SHA512

      a739b342622f6949f3238b18b8c51ecbddfa61ddd6d2b18b83bff9f9b72a9c9774aca871f547ace1d41a123d756e3498babd6eb42d9b4e42f3c32e2ec91bdc56

    • SSDEEP

      192:oM+q8B50G4urQDIN9+H27uci5akloQROGHb0m1f8uk2R6Ct9gpCIHOmJTmFLauQ:l8Lv4urQ89mAu9YzafAGk2RnyYBPTQ

    Score
    10/10
    guloaderdiscoverydownloaderexecution

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks