guloader | 83ba4e290da54c23797a42fb6d97b9381a067134c8a19267071182ab8595473d

Sharing

Copy URL

Twitter E-mail

General

Target

18945462165.zip
Size

427KB
Sample

240911-z33vqstbpk
MD5

dc106ff318efa18fcb41100363659989
SHA1

9d2b010d111b18855b618c4e0348be9bacd290e2
SHA256

83ba4e290da54c23797a42fb6d97b9381a067134c8a19267071182ab8595473d
SHA512

99d4e7d36ff2d8dfdc99b26781e94d6274e1b76020e5d8cd53a8e5fc58cb675fc478e2394f3a8d1c3d066c9056e4267651a1cc4315b42ba149b1ee5465b489e0
SSDEEP

12288:n5mlQ8ZCBp0LPkqC1JLi8x/qboOT328L+0/TN:gQmCAPkDf/rp8L+0/TN

Score

10^/10

Malware Config

Targets

- Target
  
  3474cb43e12ca472dbfbafd53c6c74ce69e31d795a8cdbfac3a5a6fcfb3cedb6
- Size
  
  427KB
- MD5
  
  bb4913da413e00345a14bcc60505796b
- SHA1
  
  a9d470fe541b7ed668bb48d71db15eeb97d20047
- SHA256
  
  3474cb43e12ca472dbfbafd53c6c74ce69e31d795a8cdbfac3a5a6fcfb3cedb6
- SHA512
  
  2867a61ef8749c5a97ab91297e5fbaf36f936a62ba3312b5c3780cd91cc7b30688ccecf59010e5d45162819602e7d6abfa196128b3b3fdbb907b9e7dd35775ce
- SSDEEP
  
  6144:kgUOFUBE1LDEyqdeyQvw/svgI1vyAdlrCatN31hKuMApb7tae/mFHuz1qDiN86:kVex4H0Znxnlr3hUAp8hhA86
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  3474cb43e12ca472dbfbafd53c6c74ce69e31d795a8cdbfac3a5a6fcfb3cedb6
- Size
  
  503KB
- MD5
  
  4b9c7f1e6218ae4264dd3529e69a81b5
- SHA1
  
  011defe93e39938465aaa2254a5fd8dfbb6d383b
- SHA256
  
  4b89405fc4cce8eb356746f1040c6af6bc90942659c3aff12c42a78d531a48d6
- SHA512
  
  d3a2ee73d7295fdfb093bee54e187dca9c0bfefa2baa0ab8d5b93cbbada2883534644002311fbe450c410f2f522e2126b13394d4cf6525ce86ae111bcd0d47f9
- SSDEEP
  
  12288:ubZxvzlLYN4fYSq7UpiiArc3mYAR27YAC1:WZxpflpiFymHR2b
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  Benefit_Signature_Plan#3762.com
- Size
  
  501KB
- MD5
  
  4c906f03f8cbdcd7c66a15f6c8498330
- SHA1
  
  91e1270fc52b760ff2913f2db910f78c6051b74d
- SHA256
  
  cff42a20c90a525f62cf6c71c7362a9b94765f00f25c29faa20f2a0d67090ba8
- SHA512
  
  2ca1a394952bf0cef296f9015585b9a3bc261958350ed19e43adc4e778050320d46ac7f1854093f330a4000e4123361765769db2a569f93750f917e10564f717
- SSDEEP
  
  12288:pbZxvzlLYN4fYSq7UpiiArc3mYAR27YAC1/:xZxpflpiFymHR2bI
Score

10^/10

guloader collection credential_access discovery downloader spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  9625d5b1754bc4ff29281d415d27a0fd
- SHA1
  
  80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA256
  
  c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- SHA512
  
  dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP
  
  192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  Brilliantly23.sla
- Size
  
  278KB
- MD5
  
  6e484e8f0ba8a805ab53c0674dbd65b1
- SHA1
  
  2e08b37c93b1e4bf88dd586362fb6c66cac43b3c
- SHA256
  
  0100611bf19f40a6338b81dfa56c42d15ede33156475f28b2e575a554d3dc272
- SHA512
  
  0279b2949ef629a904b5460f5f44906c612c099df55565daf1b742a43b2819ff44ba075ee23ca41e10e57b045c84a4b1e5118e413f2f9a2ae41dc69d39190b81
- SSDEEP
  
  768:XlGRhWx8wlurrwmqGASVbZftzixOojM5WoXEFsMqjzr0m8D0aIA8pPgNHGiAv7Hg:X+hwK1d9ZvkfhGzj9Wggen
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  Cibola.Cer
- Size
  
  6KB
- MD5
  
  b81f676cb5543fb22c6ae843b8ced728
- SHA1
  
  dee44052685594c11d35d1d193be2ce32e7b0704
- SHA256
  
  2ba90ce7789f40e156454593510c46025d104db61862da14a73c8fdd01d4fd09
- SHA512
  
  934a105f910b46a2861fa978ea2e9a6da614140849ce57c6e089b56418a811e741435d89cdf95316a2337c3f51a0b7a10c06253d7944959a0187d2227ef39aa9
- SSDEEP
  
  96:Zl/7aYfhFr81M5qD9W36G9raQ7Ff+LHn/T/dsYGHkYmA/QdvYXo7t:ZlpJ90M5nq6raYFfmHnrV41mA/YY4J
Score

1^/10
behavioral11 behavioral12
- Target
  
  Micass.txt
- Size
  
  392B
- MD5
  
  7b75ece01ee08564fe9089a4c04c6a11
- SHA1
  
  5f7d987e7c866c8a493fab715fb275e846c03fc5
- SHA256
  
  f2d161366ed4db52a59bf78f6844cf36d08da2b3371bf321643dfd1ec8644c29
- SHA512
  
  ce6f1c30f012e52dd73a23732eb0b898531a8d10d467b9062410842f39c78f4f45e38d1b09a70a4d42892c10243c41a0416d5fca540611d96519a655891bf8cf
Score

1^/10
behavioral13 behavioral14
- Target
  
  Whosome.sag
- Size
  
  154KB
- MD5
  
  bdc5e1bbf2a7a973e9cc850f592d1869
- SHA1
  
  2784dd320b5d32ca6e7d1575657bef7eab5a1c13
- SHA256
  
  68697bfb7295167b6af1227c40772ae6faf0e7be30c996e5e7818c100a935a2c
- SHA512
  
  14aef34ba5efac4d84cca8b20ae5998caef4c701e1479799f09f322701127cca229d22f2a95b61c9fec7e410026cb820f9d5a0b612f42c0df9e5fe27046e2e66
- SSDEEP
  
  768:8+5KsoZIYCzprf32gkY3rucPMsNWDKk+Zu6cXOIKP8yYpVLYKAbi1iUD:6mDJNB
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  arbejdskapacitet.dds
- Size
  
  235KB
- MD5
  
  a1a66617ef9a171f94198d7fc3063307
- SHA1
  
  857e2f61dc7c23b270616e47249888badc289c24
- SHA256
  
  d6a845df1d50fa2292bd3bd5a7c3ba6ffa2c065946c497125c5b954b82732137
- SHA512
  
  9614f703a055d539772a3b3e3ccaeb5a371a16b696e4ee5d0e17e3fbd1c75158934c3488d99dd3aee0fb89058f24694c99f875168cfc5f61f67df154fdbcb10b
- SSDEEP
  
  768:sxtcPAHD55RmbaKl5o0H4LGwNyTmhd90Tt93+n0jQ6rktUBN60ho8DV07Qu9rVja:sb1clwdhkTv3+DY60ZGQkj6yce+
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  bermudashortsene.Env
- Size
  
  276KB
- MD5
  
  e06a0946e057e315affc260c204cdc0e
- SHA1
  
  0c1ef05c8d51265a7c74189991d991402a6825d7
- SHA256
  
  1c500e7d838da0599cc08998bff2ae7a4ff164dd0d14fcd68276d8738b8100e6
- SHA512
  
  beb8e3894f433ffe1088cbeab47e302c96d8a83cf522ce8cfa3176c9155b344d96a7ff0a0d59b5450cea5588affaf09555ae2e15daf04e00ea2615821f14348f
- SSDEEP
  
  6144:wWcBZ4Uh17EpQUjQXXHQAh1EjQrCuxScxkmK9iuB6:oBZh/4p7SXjPEjGCuoqKYuB6
Score

3^/10

discovery
behavioral19 behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Credentials from Password Stores: Credentials from Web Browsers

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20