Overview

overview

10

Static

static

1

Factura_01...df.vbs

windows7-x64

10

Factura_01...df.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Factura_019827156·pdf.vbs

  • Size

    30KB

  • Sample

    240923-reeh8sybll

  • MD5

    f7c51f5b7f54d32f737986ddc8e72cd7

  • SHA1

    5cd384df138b60f1d42c8c0067f493c30028771d

  • SHA256

    645e4eea68674f941ad022f1470287f2fd140937b5df5aad9b084ba9db2d9c1c

  • SHA512

    91dc23ede4c683feb25594d67e2e6038362b3ee1490d813a61129e038cc88b3719af9f26cf1580de561f26a188065a8d654541ecfe84bf8b66fdaa86471f7a8c

  • SSDEEP

    384:3cb8FSMdEtNU3PgCDZYNqkUTtD1WYDJO8HbLc252J:u8FRwSYCDGYDTtEYDJLHnc

Score
10/10
guloaderdiscoverydownloaderexecution

Malware Config

Targets

    • Target

      Factura_019827156·pdf.vbs

    • Size

      30KB

    • MD5

      f7c51f5b7f54d32f737986ddc8e72cd7

    • SHA1

      5cd384df138b60f1d42c8c0067f493c30028771d

    • SHA256

      645e4eea68674f941ad022f1470287f2fd140937b5df5aad9b084ba9db2d9c1c

    • SHA512

      91dc23ede4c683feb25594d67e2e6038362b3ee1490d813a61129e038cc88b3719af9f26cf1580de561f26a188065a8d654541ecfe84bf8b66fdaa86471f7a8c

    • SSDEEP

      384:3cb8FSMdEtNU3PgCDZYNqkUTtD1WYDJO8HbLc252J:u8FRwSYCDGYDTtEYDJLHnc

    Score
    10/10
    guloaderdiscoverydownloaderexecution

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks