Overview

overview

10

Static

static

3

0b2441e984...a4.exe

windows7-x64

10

0b2441e984...a4.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

henk/Addle...ko.com

windows7-x64

henk/Addle...ko.com

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b2441e984653fdb0907557a75c1798b13bb62e338c65a554bc3360c5ec5a8a4

  • Size

    699KB

  • Sample

    241029-yce6baxmgw

  • MD5

    992da08bbb3e1de654a353eed8b8fba4

  • SHA1

    316224c8abb98dbd3e2c908b29fc8ea852549784

  • SHA256

    0b2441e984653fdb0907557a75c1798b13bb62e338c65a554bc3360c5ec5a8a4

  • SHA512

    58a2d6ae10aa4088912fc65257b96722352b002dec68837e03ce02a481569ff31ecdbfed1d5f3db1c70af5c84a14c2706b94a9dff5261db6b040ce353ed6afff

  • SSDEEP

    12288:0QszxdK1xIHkD5/wHpmHfgfTDLeQF+DyWE8N8kkT+KdlDjspRaFhCyiNutx:WwcpmHfgfvC4+WWfN8kkT+Kd9utsn

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      0b2441e984653fdb0907557a75c1798b13bb62e338c65a554bc3360c5ec5a8a4

    • Size

      699KB

    • MD5

      992da08bbb3e1de654a353eed8b8fba4

    • SHA1

      316224c8abb98dbd3e2c908b29fc8ea852549784

    • SHA256

      0b2441e984653fdb0907557a75c1798b13bb62e338c65a554bc3360c5ec5a8a4

    • SHA512

      58a2d6ae10aa4088912fc65257b96722352b002dec68837e03ce02a481569ff31ecdbfed1d5f3db1c70af5c84a14c2706b94a9dff5261db6b040ce353ed6afff

    • SSDEEP

      12288:0QszxdK1xIHkD5/wHpmHfgfTDLeQF+DyWE8N8kkT+KdlDjspRaFhCyiNutx:WwcpmHfgfvC4+WWfN8kkT+Kd9utsn

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      4d3b19a81bd51f8ce44b93643a4e3a99

    • SHA1

      35f8b00e85577b014080df98bd2c378351d9b3e9

    • SHA256

      fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce

    • SHA512

      b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622

    • SSDEEP

      192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      henk/Addleheadedness/chechako.com

    • Size

      455KB

    • MD5

      716783bb1d3664c916795e809845bcf9

    • SHA1

      22a0076526207aff8c83250a30dfe3f44cba90a3

    • SHA256

      7628e5edd0245fb03671199dc1f8e7fe18b4cdfcedd9a9569213d8a14a776f88

    • SHA512

      3977ea2c5642f821e46cafe5d71f0457a30b375a1c5599c44f44c220e4751ea2b6bacee16a21bb30297e88ba1cdc9345ca2186b503d2b6be8ee14ecf1b8952fd

    • SSDEEP

      1536:ddmZ/2sgaTmJd0qcED+kbCZznzj/y5kv44558hoY6fEo:ddoTiwHy5kvH6hqfEo

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks