guloader | ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66

General

Target
ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe
Size 717KB
Sample241107-rn3meswnal
SHA256 ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66
MD5 880321afc15e4ba38ce4c6c4e0a512e4
SHA1 b3b15390ccc25cf74df2aea1a20269e06b54a6d7
SHA512 4939777bc3b5ea2968df32a32eb47a7a168c531a2d2c7ae40a9c3bd6c2758f59042ba51a9d8a870be881b673385dff97164ac27a901d748f413c71bb824e24fe
SSDEEP 12288:irgjBLiIK2WVy/YqpuSKSKl/oSRHW2ugcYdUsr5aoWy8ihXmmwMRzcLSIHB:i0jBiIK2R/5puSsJoSknqUO5DXjZcWIh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe
- Size 717KB
- SHA256 ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66
- MD5 880321afc15e4ba38ce4c6c4e0a512e4
- SHA1 b3b15390ccc25cf74df2aea1a20269e06b54a6d7
- SHA512 4939777bc3b5ea2968df32a32eb47a7a168c531a2d2c7ae40a9c3bd6c2758f59042ba51a9d8a870be881b673385dff97164ac27a901d748f413c71bb824e24fe
- SSDEEP 12288:irgjBLiIK2WVy/YqpuSKSKl/oSRHW2ugcYdUsr5aoWy8ihXmmwMRzcLSIHB:i0jBiIK2R/5puSsJoSknqUO5DXjZcWIh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery guloader downloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader family

Guloader,Cloudeye

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4