Overview

overview

10

Static

static

3

FUNDS TRAN...if.exe

windows7-x64

10

FUNDS TRAN...if.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.pif.exe

  • Size

    729KB

  • Sample

    241031-rrae2s1ndk

  • MD5

    fb4e88fe6e801bd1770fa1b91ead7bfa

  • SHA1

    3739fd72191b66dce2213abf4ae610ede85efbca

  • SHA256

    c192c16aba9f5bb5ce6eca9e5fff24bbc290e5b820f94868466a61f6d0a2df8e

  • SHA512

    388e96504ab2590600349a91066882a2ce5f3acf74431ae4d6b02475e443a660eb9f374380159f46384ab401bcd56cff053eac4c553ddfd1b767bfa0ea8e9ad2

  • SSDEEP

    12288:DhoX5zcKxyCiN0DSNYCqbf07Ku7DdrJ++F6DJIG6pWu2PACkfwFLuz:Dw4U80DUY1bfyKQ9c+IDPhu2PAX7

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.pif.exe

    • Size

      729KB

    • MD5

      fb4e88fe6e801bd1770fa1b91ead7bfa

    • SHA1

      3739fd72191b66dce2213abf4ae610ede85efbca

    • SHA256

      c192c16aba9f5bb5ce6eca9e5fff24bbc290e5b820f94868466a61f6d0a2df8e

    • SHA512

      388e96504ab2590600349a91066882a2ce5f3acf74431ae4d6b02475e443a660eb9f374380159f46384ab401bcd56cff053eac4c553ddfd1b767bfa0ea8e9ad2

    • SSDEEP

      12288:DhoX5zcKxyCiN0DSNYCqbf07Ku7DdrJ++F6DJIG6pWu2PACkfwFLuz:Dw4U80DUY1bfyKQ9c+IDPhu2PAX7

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c61501f07cf09bcfcdfe4cc8a1ebbbe3

    • SHA1

      e8581b4359651b857646ae727efaaef372daa0fc

    • SHA256

      7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55

    • SHA512

      9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24

    • SSDEEP

      192:Kk09rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:Kk0JQEaVAK7R9SfpjpQYLRszfH/d9CWv

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks