guloader | 2fba62d26b23162edc673374335d575688b00d1467d936618793d28ec3729ad6

General

Target
Stadigheder43.exe
Size 894KB
Sample241030-qech7stfng
SHA256 2fba62d26b23162edc673374335d575688b00d1467d936618793d28ec3729ad6
MD5 aa160f24e5670e39abcc8a33c6f51f2f
SHA1 eb8f77c8f6c5699614e304d8e7f8a3950ba41a4a
SHA512 8261633df47cad2dab42508a8f1c9d421b0b0c91d62a8b08bf3787c19b7116f3f091791800983bcd9d75d92b0097c08c670a38963ef4effd04e70ffc4cb9565e
SSDEEP 24576:2x+rcb2ZkoncoAzPLqt62HnQIQMOKOaeKf:2x+4b2SoncFzPLH2HTzOKOwf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Stadigheder43.exe
- Size 894KB
- SHA256 2fba62d26b23162edc673374335d575688b00d1467d936618793d28ec3729ad6
- MD5 aa160f24e5670e39abcc8a33c6f51f2f
- SHA1 eb8f77c8f6c5699614e304d8e7f8a3950ba41a4a
- SHA512 8261633df47cad2dab42508a8f1c9d421b0b0c91d62a8b08bf3787c19b7116f3f091791800983bcd9d75d92b0097c08c670a38963ef4effd04e70ffc4cb9565e
- SSDEEP 24576:2x+rcb2ZkoncoAzPLqt62HnQIQMOKOaeKf:2x+4b2SoncFzPLH2HTzOKOwf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
- MD5 c9473cb90d79a374b2ba6040ca16e45c
- SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
- SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
- SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader family

Guloader,Cloudeye

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4