Overview

overview

10

Static

static

3

28dbe1a424...1d.exe

windows7-x64

10

28dbe1a424...1d.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Funktionrg...an.dll

windows7-x64

3

Funktionrg...an.dll

windows10-2004-x64

3

Funktionrg...mp.dll

windows7-x64

1

Funktionrg...mp.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe

  • Size

    242KB

  • Sample

    241115-crfvhaxbql

  • MD5

    bd85503dd4bb3ccd9c6c294d3767d8e6

  • SHA1

    d98455443474b9aef06f1bff242a52e8bb4ec6d0

  • SHA256

    28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d

  • SHA512

    b6eeaa15f7c6573ec15208bc071d1d953404c7bd3cd06e4bd0cb2ab93e7678eb2c7425c7fe317c5f0e7f5fc9145cb14686c8157b5a0ab0b6e8a00bd6b0e2972d

  • SSDEEP

    6144:oIw3gEzFzShNZA1lZqrq6DHSCf7NVMf/WB/UvuEIN:jA2Ha172xSE7LMXWlUvuES

Score
10/10
guloaderdiscoverydownloaderpersistence

Malware Config

Targets

    • Target

      28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe

    • Size

      242KB

    • MD5

      bd85503dd4bb3ccd9c6c294d3767d8e6

    • SHA1

      d98455443474b9aef06f1bff242a52e8bb4ec6d0

    • SHA256

      28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d

    • SHA512

      b6eeaa15f7c6573ec15208bc071d1d953404c7bd3cd06e4bd0cb2ab93e7678eb2c7425c7fe317c5f0e7f5fc9145cb14686c8157b5a0ab0b6e8a00bd6b0e2972d

    • SSDEEP

      6144:oIw3gEzFzShNZA1lZqrq6DHSCf7NVMf/WB/UvuEIN:jA2Ha172xSE7LMXWlUvuES

    Score
    10/10
    guloaderdiscoverydownloaderpersistence

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      9625d5b1754bc4ff29281d415d27a0fd

    • SHA1

      80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

    • SHA256

      c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

    • SHA512

      dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

    • SSDEEP

      192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Funktionrgruppen/Madreporaria/SpeedFan.dll

    • Size

      8KB

    • MD5

      4116df38affa70b0dbe316301af91284

    • SHA1

      89aaa790c37e7955e637a81915be1e034820bd62

    • SHA256

      457dc3c84fbc73e5586f3c26208363cc09930977462faef7ab6c9eb18798a563

    • SHA512

      733709ffbda2f3680680a89fa7834a71750e830b71e7a972a707e2a925e9682b2604df34724aad70f37578a88cd32eccab8cbf8b74b4a62b0d0b0066cda61b15

    • SSDEEP

      96:pBemi5bbIEr12o9aOSPoBSeQLSprbNJoi2YmSVjfb:P4qA3SAkeQLSprbNP5jf

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      Funktionrgruppen/Madreporaria/libpixbufloader-bmp.dll

    • Size

      24KB

    • MD5

      e3b0fe154060a55b0163c61017032d34

    • SHA1

      00b3217c02b7436e14dc5138c51d43cd55408f2c

    • SHA256

      a39234bc4ea6dbac3af8df80dabf71a6391e26b360efa8e5300c48045e0745bb

    • SHA512

      0a860b02788fdc85467d73278af7c4d470683a2562d2834f738ef7bc587004914e23bde66967eb237d330d4090d21a596435501cfbccf0dbe822088ae7c8efc1

    • SSDEEP

      384:Lgzt9vfDs+UH7rtF2Xu3d/FzZphz8GJPJOsHtXXXXXXXXXXXXXXmyatIvwrKOAMM:Lgt9vbctcXu3BFpAGJPJ/H8y0Dbx2

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks