guloader | d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5

General

Target
d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5.exe
Size 914KB
Sample241024-cqynxszekd
SHA256 d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5
MD5 5a58e2348883014d1b494ab38035d4df
SHA1 b63e0dc98ca87974a735a00c3cb0531d4c2e49de
SHA512 5a0b99b841ec86581c8adfe8a6ec80ec64dc1361b0ded0e158f2f03536a2ad393aa19ebeb56d1f4f94cd64233c6e3ebad830db4bff216c35cc8dce70b57bd677
SSDEEP 12288:JSl6vY7dH2a0fHhfCEeRnVXCb95Feh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcvs:slcY7dH2aShcVX09W2UVf+DLD1BbYGU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5.exe
- Size 914KB
- SHA256 d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5
- MD5 5a58e2348883014d1b494ab38035d4df
- SHA1 b63e0dc98ca87974a735a00c3cb0531d4c2e49de
- SHA512 5a0b99b841ec86581c8adfe8a6ec80ec64dc1361b0ded0e158f2f03536a2ad393aa19ebeb56d1f4f94cd64233c6e3ebad830db4bff216c35cc8dce70b57bd677
- SSDEEP 12288:JSl6vY7dH2a0fHhfCEeRnVXCb95Feh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcvs:slcY7dH2aShcVX09W2UVf+DLD1BbYGU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
- MD5 cf85183b87314359488b850f9e97a698
- SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
- SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
- SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4