Overview

overview

10

Static

static

3

rMactation.exe

windows7-x64

10

rMactation.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rMactation.exe

  • Size

    914KB

  • Sample

    241023-rx3zjsvepf

  • MD5

    5a58e2348883014d1b494ab38035d4df

  • SHA1

    b63e0dc98ca87974a735a00c3cb0531d4c2e49de

  • SHA256

    d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5

  • SHA512

    5a0b99b841ec86581c8adfe8a6ec80ec64dc1361b0ded0e158f2f03536a2ad393aa19ebeb56d1f4f94cd64233c6e3ebad830db4bff216c35cc8dce70b57bd677

  • SSDEEP

    12288:JSl6vY7dH2a0fHhfCEeRnVXCb95Feh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcvs:slcY7dH2aShcVX09W2UVf+DLD1BbYGU

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      rMactation.exe

    • Size

      914KB

    • MD5

      5a58e2348883014d1b494ab38035d4df

    • SHA1

      b63e0dc98ca87974a735a00c3cb0531d4c2e49de

    • SHA256

      d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5

    • SHA512

      5a0b99b841ec86581c8adfe8a6ec80ec64dc1361b0ded0e158f2f03536a2ad393aa19ebeb56d1f4f94cd64233c6e3ebad830db4bff216c35cc8dce70b57bd677

    • SSDEEP

      12288:JSl6vY7dH2a0fHhfCEeRnVXCb95Feh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcvs:slcY7dH2aShcVX09W2UVf+DLD1BbYGU

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      cf85183b87314359488b850f9e97a698

    • SHA1

      6b6c790037eec7ebea4d05590359cb4473f19aea

    • SHA256

      3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

    • SHA512

      fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

    • SSDEEP

      96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks