guloader | 25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066

General

Target
25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066.exe
Size 694KB
Sample241111-cmkynazjht
SHA256 25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066
MD5 964744dc0ee9f5fcb1c2d50553c1a080
SHA1 b097808717cf2aed2109c0191b6a32471a97b1c5
SHA512 9151bfa7447126013681209b92e46f8049a8bea2d09fb972a19942795d0a16274c191bbb654eb66465011da5260fc34c08b0eb456348ab377e5bde1aa90713f0
SSDEEP 12288:sMwaWgmqtOAmk6kIATs0yjE8HELsQP04nwNtsgw3PgAeeVhGctH74:sMwaWgqkJIAw0yghs2f2Mobev74
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
mail.foodex.com.pk
Port
587
Username
[email protected]
Password
wajahat1975
Email to
[email protected]

Targets

- Target
  25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066.exe
- Size 694KB
- SHA256 25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066
- MD5 964744dc0ee9f5fcb1c2d50553c1a080
- SHA1 b097808717cf2aed2109c0191b6a32471a97b1c5
- SHA512 9151bfa7447126013681209b92e46f8049a8bea2d09fb972a19942795d0a16274c191bbb654eb66465011da5260fc34c08b0eb456348ab377e5bde1aa90713f0
- SSDEEP 12288:sMwaWgmqtOAmk6kIATs0yjE8HELsQP04nwNtsgw3PgAeeVhGctH74:sMwaWgqkJIAw0yghs2f2Mobev74
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader vipkeylogger keylogger stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Guloader family

Guloader,Cloudeye

VIPKeylogger

Vipkeylogger family

Loads dropped DLL

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4