Overview

overview

10

Static

static

3

rNuevo_Ped...49.exe

windows7-x64

7

rNuevo_Ped...49.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

frlighed.app

macos-10.15-amd64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rNuevo_Pedido_129149.exe

  • Size

    750KB

  • Sample

    241022-yrh6hs1flc

  • MD5

    5c64ce5f7c6b88767f77b788a4fb5b19

  • SHA1

    05cf5307feb87910eef79cec65ee8ab1613e28a9

  • SHA256

    8d9cacf5c0689e332f4e043117ecdc533edf1b52b65179885ceb284ff706a6fe

  • SHA512

    25caeddc9d0c42b0ab1d7f6d81303c3b44be9adb3ce5e1ac49f3c78b5cd98c6f05ff07c49c0b79b2d140cb520a0f7bfbf1a7ffe549018417dd1ac44e25c0e045

  • SSDEEP

    12288:AuO/1lVnS6t0bXm0Uf+2Pvmj8vZ8piCM3dj3DcLIPDgMlXZo+LLhz78q6TMmC93V:Q/1lYFLmVft2j15MNj3wLsA+f54qQMmM

Score
10/10
guloaderdiscoverydownloadermacos

Malware Config

Targets

    • Target

      rNuevo_Pedido_129149.exe

    • Size

      750KB

    • MD5

      5c64ce5f7c6b88767f77b788a4fb5b19

    • SHA1

      05cf5307feb87910eef79cec65ee8ab1613e28a9

    • SHA256

      8d9cacf5c0689e332f4e043117ecdc533edf1b52b65179885ceb284ff706a6fe

    • SHA512

      25caeddc9d0c42b0ab1d7f6d81303c3b44be9adb3ce5e1ac49f3c78b5cd98c6f05ff07c49c0b79b2d140cb520a0f7bfbf1a7ffe549018417dd1ac44e25c0e045

    • SSDEEP

      12288:AuO/1lVnS6t0bXm0Uf+2Pvmj8vZ8piCM3dj3DcLIPDgMlXZo+LLhz78q6TMmC93V:Q/1lYFLmVft2j15MNj3wLsA+f54qQMmM

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      12b140583e3273ee1f65016becea58c4

    • SHA1

      92df24d11797fefd2e1f8d29be9dfd67c56c1ada

    • SHA256

      014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

    • SHA512

      49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

    • SSDEEP

      192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      frlighed.app

    • Size

      253KB

    • MD5

      df7575b0a922eb9254c2fd55589079b5

    • SHA1

      48e2566ab591ee6bc5715f8f38d834d9742a976c

    • SHA256

      94d26d3c091c937f49c5e8a4822703c79c4b41182210daa4a9672f446bd7ffcc

    • SHA512

      41cb5a47835fe8198d6a793cbdb1f01c5420c89fb7854975cc9aa678b990b4c2ad1e3541c0212ed09413c6ac402aabce37d82595913d6d4759cec0752f889cd9

    • SSDEEP

      768:cA1hV6OhcgJ9H+VkvR1iNrNFhFO3S3nRyyFCHNDhzPZZKCVDz7nLZEXYHF5VFYao:bu4R0PIXFl5tpxiHqGgg

    Score
    1/10
    behavioral5

MITRE ATT&CK Enterprise v15

Tasks