guloader | afc7d530c112b47cd33295262f533df60f12568ede477091434381b0d6a2cc8c | Triage

Sharing

General

Target

10cd865c5ece278cad7c4bc881944d6e_JaffaCakes118
Size

112KB
Sample

241003-2ssyws1dkn
MD5

10cd865c5ece278cad7c4bc881944d6e
SHA1

f339c0a5ab3a3a40cf5d9ae5753c2e5a3ab80f5d
SHA256

afc7d530c112b47cd33295262f533df60f12568ede477091434381b0d6a2cc8c
SHA512

995eef8bbd28e8472b8450beb5398a4de1117d9634848c40978e15c09b2d55db8cb628ea9b1c6c691bbfc59503c13b66bfdad695e7311aef575a83556dca9ddb
SSDEEP

1536:Pz+JBa3z5+1v1rIzB7wT0OrPvEwYS89y94J0GGrweHkKN:yJ43z5Cv1rS7w9rPC4HB

Score

10^/10

guloader discovery downloader

Malware Config

Targets

- Target
  
  10cd865c5ece278cad7c4bc881944d6e_JaffaCakes118
- Size
  
  112KB
- MD5
  
  10cd865c5ece278cad7c4bc881944d6e
- SHA1
  
  f339c0a5ab3a3a40cf5d9ae5753c2e5a3ab80f5d
- SHA256
  
  afc7d530c112b47cd33295262f533df60f12568ede477091434381b0d6a2cc8c
- SHA512
  
  995eef8bbd28e8472b8450beb5398a4de1117d9634848c40978e15c09b2d55db8cb628ea9b1c6c691bbfc59503c13b66bfdad695e7311aef575a83556dca9ddb
- SSDEEP
  
  1536:Pz+JBa3z5+1v1rIzB7wT0OrPvEwYS89y94J0GGrweHkKN:yJ43z5Cv1rS7w9rPC4HB
Score

10^/10

guloader discovery downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderdiscoverydownloader

behavioral2

guloaderdiscoverydownloader