Overview

overview

10

Static

static

3

=XUTF-8XQX...=9.zip

windows7-x64

1

=XUTF-8XQX...=9.zip

windows10-2004-x64

1

SÖZLEŞME...df.exe

windows7-x64

10

SÖZLEŞME...df.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Baadehavnes.ugo

windows7-x64

3

Baadehavnes.ugo

windows10-2004-x64

3

Martyrizations.sim

windows7-x64

3

Martyrizations.sim

windows10-2004-x64

3

Opsamlings...19.bes

windows7-x64

3

Opsamlings...19.bes

windows10-2004-x64

3

ammunition...en.txt

windows7-x64

1

ammunition...en.txt

windows10-2004-x64

1

teleph.all

windows7-x64

3

teleph.all

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    =XUTF-8XQXS=C3=96ZLE=C5=9EME_=C5=9EARTLARI_=28YEN=C4=B0_S=C4=B0PARX=XXX=XUTF-8XQX=C4=B0=C5=9E_S=C3=96ZLE=C5=9EMES=C4=B0=29-pdf=2E7zX=

  • Size

    626KB

  • Sample

    241003-qzl85ssbje

  • MD5

    14568015337f3b80ec55d39571932f1c

  • SHA1

    a62b62c63139d1949037ff20a7ffd07c340b3262

  • SHA256

    f32c3fb0bf2016c1f8ad700fdf278a7362210900c365ec8155c2c667c97fb579

  • SHA512

    426425a714a158fe86fccc5ded9db94756cc4e05f6ab754268d57c317a63851181f58ed1fd094b33d760693711b1c92209cbd8f899300f98b7a32bbbe893d69d

  • SSDEEP

    12288:N+XLUsFgPoMyXPv2BMmuXRLNHcTGTtPV1ocvu0/oZ+fZBbumcKWuPqFqylj1b:N+7U0gPKJrcTy7oQj6+unui5

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      =XUTF-8XQXS=C3=96ZLE=C5=9EME_=C5=9EARTLARI_=28YEN=C4=B0_S=C4=B0PARX=XXX=XUTF-8XQX=C4=B0=C5=9E_S=C3=96ZLE=C5=9EMES=C4=B0=29-pdf=2E7zX=

    • Size

      626KB

    • MD5

      14568015337f3b80ec55d39571932f1c

    • SHA1

      a62b62c63139d1949037ff20a7ffd07c340b3262

    • SHA256

      f32c3fb0bf2016c1f8ad700fdf278a7362210900c365ec8155c2c667c97fb579

    • SHA512

      426425a714a158fe86fccc5ded9db94756cc4e05f6ab754268d57c317a63851181f58ed1fd094b33d760693711b1c92209cbd8f899300f98b7a32bbbe893d69d

    • SSDEEP

      12288:N+XLUsFgPoMyXPv2BMmuXRLNHcTGTtPV1ocvu0/oZ+fZBbumcKWuPqFqylj1b:N+7U0gPKJrcTy7oQj6+unui5

    Score
    1/10
    behavioral1behavioral2

    • Target

      SÖZLEŞME ŞARTLARI (YENİ SİPARİŞ SÖZLEŞMESİ)-pdf.bat

    • Size

      894KB

    • MD5

      c8c2fa1b682b0bca8ed9de83455e8977

    • SHA1

      ff96ea1f052d0e7745a4fe30bacb8362ea57ba2c

    • SHA256

      4af23250a740fc8e855879c8f0492b8be3613ef015db4347d14885f57e25ee93

    • SHA512

      d692404d369b4755e760599a50078f0240dd3a5af2af5953ad86d00eaa788c812bed59b22f19c1251bdd192a8d81a10c4d10ec9cc6a15b1e7a44bfb51c20c258

    • SSDEEP

      24576:ZFZsHTO9u9XKhrmod1RYTy7OQJs+45oi4:Z3n9i61RYeiQJBGf4

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      d968cb2b98b83c03a9f02dd9b8df97dc

    • SHA1

      d784c9b7a92dce58a5038beb62a48ff509e166a0

    • SHA256

      a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c

    • SHA512

      2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e

    • SSDEEP

      192:CVA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:CrR7SrtTv53tdtTgwF4SQbGPX36wJMw

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      Baadehavnes.Ugo

    • Size

      149KB

    • MD5

      d23af20ef332c55e7e223cfa1fd94252

    • SHA1

      04e86dced7945775523bab1d639b92334cfa327b

    • SHA256

      b9c3edb15e270673aca6a848033052cd34ebff7ab54a74adbac6c6fc4d8d79a8

    • SHA512

      c2cc54beb5243e62ed5a3fce30fc624e371b1808c04dcfe96059bc21b4ea2ce3e66a1c6db402930517704bda5d2d6d990d5de6c8028585576791e537e3feb7f8

    • SSDEEP

      3072:auH/EMGAIZ02UvVMGQHl0HrpFkCd3/z9M:JHwAIqV4F0HdFk4y

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      Martyrizations.Sim

    • Size

      347KB

    • MD5

      9632912516372eeef829abbf8d80b755

    • SHA1

      bd16f3f0049bcd88afb2582efdd0dd647e4c11f6

    • SHA256

      a4d0a3f7ca09f1d74ab0e5a3a1cb9b4aac80b482c46edabafd9f9873f95a3990

    • SHA512

      bcee99e04cce817f0d97f8b304838c594704a0d675d34059e773a1d4f5b2ff938eccc7eef51e42af06ba1b759c1ab6c4e9d3fee493a980b2d74025fd58ebd98e

    • SSDEEP

      6144:UL2HS/TAnZUvR3jz2Fwo5jCBVy7b4tqdG8lI08e9N1lr9ITNdfOHNkX0KVSb:UL2HS/q6vR33A5mzy7bpG6l2TNdfO+Hq

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      Opsamlingsbeholdere119.bes

    • Size

      405KB

    • MD5

      a6b0286190ff25673a5bbcca3e635e17

    • SHA1

      b50d863e08054654434eeead618ae36d66f5ad59

    • SHA256

      2587546927274a33be48c542ad1b98e07df0c2a8503afbc1f260ebec1cb13ede

    • SHA512

      1f9c0f6cd3be6f79168bbd9b07931181cae135d144da4e569191e42bf66c5af0be49c894e1608a4c45c3be38dfd47eb912cba4dadb660a688474b1a3f2acc72e

    • SSDEEP

      768:r1/VRVN7GaY97mbexftA4Z+RRCLDHuPxfARLhzR+9wBhtOxALX5Wa/5X6dJddvt2:LMxA4/Lf6dHgeGxN37ruZwuLi+OLj

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      ammunitionsfabrikken.txt

    • Size

      624B

    • MD5

      87f4b14cca6f39d1c934f93b13234749

    • SHA1

      9fcdd0ead74ee185f49409e0ffe86b1925cc6f77

    • SHA256

      e619e25d31210ded72b4dbae631948d4335aeae318148e864421457ef0f4ace9

    • SHA512

      13db40313fef1fdeb1d517e0664b7766328dd7dc7244741ff6b6eae62c6d0ba5ee458e058375c466c9cb6062e0d7dcc3ec3f57310604a7372f79839acafe9471

    Score
    1/10
    behavioral13behavioral14

    • Target

      teleph.all

    • Size

      307KB

    • MD5

      6957ac2ffff57f658f70a8608c653d42

    • SHA1

      a6764fe4f4fcdd48c73cb23ccca9ce19e2845935

    • SHA256

      480d36cf0de68beae5f1ed80a81aee327bba323c7b01a478e5d41bf429041f02

    • SHA512

      0b2575bdbb7de38a6d5c2d1d5c8641ec7a65f9f05e2da8cfad8f09ce47c31eeea70c891a8a42a4842f27215deddb69357de9293d57c5ecfb19cc6007b1042505

    • SSDEEP

      768:kFtpdTjsz/zhmhiCGrJI7rqVQuEB7QCGqvL2f0SQ1E2IC67MpqrchPadg+nlwAGP:mPGDDdQxvn1Xmrizhj8H3hE3MA

    Score
    3/10
    discovery
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks