General
-
Target
PolysealsSdnBhdStatementReceipts1111.exe
-
Size
674KB
-
Sample
241111-vzb6dsseqh
-
MD5
3b50d4e4dfbc3dd4616540a5f4a4c77b
-
SHA1
ecfa344492999e0b58524cd759bd1ea296c80d2f
-
SHA256
18bfaa34bea9797ca82ffa02adc900f70ad24ad9663afacf0d963ff41d3a0c17
-
SHA512
4ca6beb0446b074e05d44c9e172a2f31a2ef47ceac83c3d141524160d08e8027d4e6a5a6fdde6eddd31f227353e9e079e77068b2f74b38527d4ae7a30bf0141e
-
SSDEEP
12288:yYrwHze67C+Szoaz6PhVeYqqGrZqVY/h2guBONyc6SwLIrpwEVNNrygxj1Nj4sl/:yY8Hze6fuoOchVBqqGcVYsK6SaA75TN7
Malware Config
Targets
-
-
Target
PolysealsSdnBhdStatementReceipts1111.exe
-
Size
674KB
-
MD5
3b50d4e4dfbc3dd4616540a5f4a4c77b
-
SHA1
ecfa344492999e0b58524cd759bd1ea296c80d2f
-
SHA256
18bfaa34bea9797ca82ffa02adc900f70ad24ad9663afacf0d963ff41d3a0c17
-
SHA512
4ca6beb0446b074e05d44c9e172a2f31a2ef47ceac83c3d141524160d08e8027d4e6a5a6fdde6eddd31f227353e9e079e77068b2f74b38527d4ae7a30bf0141e
-
SSDEEP
12288:yYrwHze67C+Szoaz6PhVeYqqGrZqVY/h2guBONyc6SwLIrpwEVNNrygxj1Nj4sl/:yY8Hze6fuoOchVBqqGcVYsK6SaA75TN7
Score10/10-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL
-
Adds Run key to start application
-
Blocklisted process makes network request
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
cff85c549d536f651d4fb8387f1976f2
-
SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
-
SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
-
SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
SSDEEP
192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score3/10 -