Overview

overview

10

Static

static

3

zamowienie_22.exe

windows7-x64

7

zamowienie_22.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

frlighed.app

macos-10.15-amd64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    zamowienie_22.7z

  • Size

    733KB

  • Sample

    241022-q9lqcszgqp

  • MD5

    841ec7df640f7427c92a0c025551d84a

  • SHA1

    2253dac0174993f2f86afd460e856753e55d9c43

  • SHA256

    9f82994c5a9245dfd9233933c272efc2ae69c6b731bb090b10bdc3fc1d0df46a

  • SHA512

    fca6582f02f3faa72b956ee48e564aecc8a902a376f9a3178720df685d110759ad0438451a362c5d7812d9490e03f37870082d3374783d9f652f14a87aa9593d

  • SSDEEP

    12288:ckjjJNCW6CghT7Y89Gbj4nUoZodirMJwAkPnsbVy1LrJ6YMaypoQQO4XUW7c:ckZNC117L9G/M3XMGAkPnsJy1LrJ6ZaK

Score
10/10
guloaderdiscoverydownloadermacos

Malware Config

Targets

    • Target

      zamowienie_22.exe

    • Size

      770KB

    • MD5

      43a9a9cf3242f8b4b17cdd4ebbe2cd67

    • SHA1

      bfb47cefbc03dfd4bc868971dcce323234d5c92a

    • SHA256

      0f941fbecb454d715d1d229b0a2daaa099a9dd03599485131c49241c2ff62cce

    • SHA512

      417c7db404e5f052057973ac71d7be3d101a439b82ac983a06dda22253db13b504ddbcba07410b09110a73548934766d248260c7d9c16dff559cad27885d4cfc

    • SSDEEP

      24576:bkkDNBR1KThGMMCxMdhnPnsLy1LCMNnk+ot664:VNBbAMuMdhnPnsKGMNnk5Q64

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      12b140583e3273ee1f65016becea58c4

    • SHA1

      92df24d11797fefd2e1f8d29be9dfd67c56c1ada

    • SHA256

      014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

    • SHA512

      49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

    • SSDEEP

      192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      frlighed.app

    • Size

      253KB

    • MD5

      df7575b0a922eb9254c2fd55589079b5

    • SHA1

      48e2566ab591ee6bc5715f8f38d834d9742a976c

    • SHA256

      94d26d3c091c937f49c5e8a4822703c79c4b41182210daa4a9672f446bd7ffcc

    • SHA512

      41cb5a47835fe8198d6a793cbdb1f01c5420c89fb7854975cc9aa678b990b4c2ad1e3541c0212ed09413c6ac402aabce37d82595913d6d4759cec0752f889cd9

    • SSDEEP

      768:cA1hV6OhcgJ9H+VkvR1iNrNFhFO3S3nRyyFCHNDhzPZZKCVDz7nLZEXYHF5VFYao:bu4R0PIXFl5tpxiHqGgg

    Score
    1/10
    behavioral5

MITRE ATT&CK Enterprise v15

Tasks