guloader | 3474cb43e12ca472dbfbafd53c6c74ce69e31d795a8cdbfac3a5a6fcfb3cedb6

General

Target

3474cb43e12ca472dbfbafd53c6c74ce69e31d795a8cdbfac3a5a6fcfb3cedb6.unknown
Size

427KB
Sample

240912-hepjrswcpm
MD5

bb4913da413e00345a14bcc60505796b
SHA1

a9d470fe541b7ed668bb48d71db15eeb97d20047
SHA256

3474cb43e12ca472dbfbafd53c6c74ce69e31d795a8cdbfac3a5a6fcfb3cedb6
SHA512

2867a61ef8749c5a97ab91297e5fbaf36f936a62ba3312b5c3780cd91cc7b30688ccecf59010e5d45162819602e7d6abfa196128b3b3fdbb907b9e7dd35775ce
SSDEEP

6144:kgUOFUBE1LDEyqdeyQvw/svgI1vyAdlrCatN31hKuMApb7tae/mFHuz1qDiN86:kVex4H0Znxnlr3hUAp8hhA86

Score

10^/10

Malware Config

Targets

- Target
  
  Benefit_Signature_Plan#3762.com
- Size
  
  501KB
- MD5
  
  4c906f03f8cbdcd7c66a15f6c8498330
- SHA1
  
  91e1270fc52b760ff2913f2db910f78c6051b74d
- SHA256
  
  cff42a20c90a525f62cf6c71c7362a9b94765f00f25c29faa20f2a0d67090ba8
- SHA512
  
  2ca1a394952bf0cef296f9015585b9a3bc261958350ed19e43adc4e778050320d46ac7f1854093f330a4000e4123361765769db2a569f93750f917e10564f717
- SSDEEP
  
  12288:pbZxvzlLYN4fYSq7UpiiArc3mYAR27YAC1/:xZxpflpiFymHR2bI
Score

10^/10

guloader collection credential_access discovery downloader spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  9625d5b1754bc4ff29281d415d27a0fd
- SHA1
  
  80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA256
  
  c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- SHA512
  
  dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP
  
  192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
Score

3^/10

discovery
behavioral3 behavioral4