Overview

overview

10

Static

static

3

2c513c65f7...18.exe

windows7-x64

10

2c513c65f7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c513c65f7f72438cc02d1bbd86e4e21_JaffaCakes118

  • Size

    148KB

  • Sample

    241009-g1g65s1ema

  • MD5

    2c513c65f7f72438cc02d1bbd86e4e21

  • SHA1

    8749f479771479c4805e2d495b7fadb3e509e047

  • SHA256

    7c58072332e83901d512567fec2eecacc2d29015a7ffcb2ecc8381b97cb8c998

  • SHA512

    91e29e1ab57845f3081cb1291d65210c9c3612f8fda93aa189a357c2b92bb4c0f72e439c7cb9fec11f4b9ad4a31f5aa2760a8e370763b777f0fc32236b5c2241

  • SSDEEP

    1536:d8YX1xRhdA1l1Uf1msyJIS5YPdby5mxlr1gbtV9DwJAM:jFLuv81JDuYle56ran5g

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      2c513c65f7f72438cc02d1bbd86e4e21_JaffaCakes118

    • Size

      148KB

    • MD5

      2c513c65f7f72438cc02d1bbd86e4e21

    • SHA1

      8749f479771479c4805e2d495b7fadb3e509e047

    • SHA256

      7c58072332e83901d512567fec2eecacc2d29015a7ffcb2ecc8381b97cb8c998

    • SHA512

      91e29e1ab57845f3081cb1291d65210c9c3612f8fda93aa189a357c2b92bb4c0f72e439c7cb9fec11f4b9ad4a31f5aa2760a8e370763b777f0fc32236b5c2241

    • SSDEEP

      1536:d8YX1xRhdA1l1Uf1msyJIS5YPdby5mxlr1gbtV9DwJAM:jFLuv81JDuYle56ran5g

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks