Overview

overview

10

Static

static

3

rNuevo_Ped...49.exe

windows7-x64

7

rNuevo_Ped...49.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rNuevo_Pedido_129149.exe.zip

  • Size

    718KB

  • Sample

    241104-vfn1vatcjc

  • MD5

    fcfab50501daf96e1e50beafc64bc3e0

  • SHA1

    b6e468fb3c7fdb1f900089dcadd156bf40951cb7

  • SHA256

    49d77fe4dcc3c298e34fbe0e290386fce46bac21f1289fc036b0732aca5c47ce

  • SHA512

    095b55de788addd1e24b470e44cc15bd90a5914b57eb749caa97065fae50f8db72544052a65e64ec501ced4b393b21d832113874ff0f8b074f4563eeee255db5

  • SSDEEP

    12288:8OiWhKMQhqq9jEijHZ0Ha8E1tm0GXbN/a/eIC5VuGiaW4vgH/sU2nwrcZHEy:NEbPjHCHa8E1t7Gpy/fC5Ve4vOUU2woN

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      rNuevo_Pedido_129149.exe.bin

    • Size

      750KB

    • MD5

      5c64ce5f7c6b88767f77b788a4fb5b19

    • SHA1

      05cf5307feb87910eef79cec65ee8ab1613e28a9

    • SHA256

      8d9cacf5c0689e332f4e043117ecdc533edf1b52b65179885ceb284ff706a6fe

    • SHA512

      25caeddc9d0c42b0ab1d7f6d81303c3b44be9adb3ce5e1ac49f3c78b5cd98c6f05ff07c49c0b79b2d140cb520a0f7bfbf1a7ffe549018417dd1ac44e25c0e045

    • SSDEEP

      12288:AuO/1lVnS6t0bXm0Uf+2Pvmj8vZ8piCM3dj3DcLIPDgMlXZo+LLhz78q6TMmC93V:Q/1lYFLmVft2j15MNj3wLsA+f54qQMmM

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks