guloader | d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5 | Triage

Sharing

General

Target

d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5.exe
Size

914KB
Sample

241024-cqynxszekd
MD5

5a58e2348883014d1b494ab38035d4df
SHA1

b63e0dc98ca87974a735a00c3cb0531d4c2e49de
SHA256

d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5
SHA512

5a0b99b841ec86581c8adfe8a6ec80ec64dc1361b0ded0e158f2f03536a2ad393aa19ebeb56d1f4f94cd64233c6e3ebad830db4bff216c35cc8dce70b57bd677
SSDEEP

12288:JSl6vY7dH2a0fHhfCEeRnVXCb95Feh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcvs:slcY7dH2aShcVX09W2UVf+DLD1BbYGU

Score

10^/10

guloader discovery downloader

Malware Config

Targets

- Target
  
  d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5.exe
- Size
  
  914KB
- MD5
  
  5a58e2348883014d1b494ab38035d4df
- SHA1
  
  b63e0dc98ca87974a735a00c3cb0531d4c2e49de
- SHA256
  
  d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5
- SHA512
  
  5a0b99b841ec86581c8adfe8a6ec80ec64dc1361b0ded0e158f2f03536a2ad393aa19ebeb56d1f4f94cd64233c6e3ebad830db4bff216c35cc8dce70b57bd677
- SSDEEP
  
  12288:JSl6vY7dH2a0fHhfCEeRnVXCb95Feh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcvs:slcY7dH2aShcVX09W2UVf+DLD1BbYGU
Score

10^/10

guloader discovery downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  cf85183b87314359488b850f9e97a698
- SHA1
  
  6b6c790037eec7ebea4d05590359cb4473f19aea
- SHA256
  
  3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
- SHA512
  
  fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
- SSDEEP
  
  96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderdiscoverydownloader

behavioral2

behavioral3

behavioral4