guloader | fabdde579b133e129408ab4ecf04fad0a9807fe70bf61383f236dcb7674999e0

General

Target
07112024_0045_06112024_Anfrage_244384.7z
Size 968KB
Sample241107-a326rssbpj
SHA256 fabdde579b133e129408ab4ecf04fad0a9807fe70bf61383f236dcb7674999e0
MD5 a5f52d0d4386ac439b9aaeb22f81e48d
SHA1 2f8b3f4eccba084ece5a71638e08e2b43172a173
SHA512 7f566ef4d2e7b3bad4daecfb3fd85661c5db964ecd4a4a35e190c7a346f660caccbb05d5c7727b01fead672161e9c44a8ab5a1f8f983aa4a14c99c284b451264
SSDEEP 24576:vKNjqIvtEU3vVbNpQZVTPhD8jJW6/6334RMHdRwciVXHEF:vKAIVE2VbI3PhD8dxI3KMHLRiVXHE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Anfrage_244384.exe
- Size 1.2MB
- SHA256 eda014e3b658bfbbfd141c1459a3414d9ee8b7c139a3976fe732141fa9cf3f80
- MD5 b03f23199ae987a7bce0ff1a0d742e3e
- SHA1 f454c8de72926ee9f98db7056fa89f0c3ada9666
- SHA512 01ccdc0f586a8926a56f0d3bfee91c5e882bff5df84cbb5363df6681fb62863a8075af8261bb72ecf2360d9d4dc4552dddb4e1ec1da002c24b9416ff0d3f95be
- SSDEEP 24576:aCAoDyk/vnt3h1CzLuTIv08yZVk7ku8h7w6/t338euHdB4bU4VD4C:aCAfqvtx1UuTIMfg7ku8Vfx3/uHHSU4t
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader family

Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4