guloader | 30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3 | Triage

Sharing

General

Target

30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe
Size

136KB
Sample

241123-z2b1masrfp
MD5

82c4a21d4ca4a085260dd4b6dc07b258
SHA1

d115a2668ec1acec9e652387e9ee04ce39e1ff73
SHA256

30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3
SHA512

4f23d20c5ccaadc998bceeee3c8e86d2cba427ed7d3b6e9278c3ba3790d3b7530ab9be2ac1db4e5a8e401ea0f13500b08ce47cbea2c01fd66d0c526d6e1a8f0f
SSDEEP

1536:7uQk9P70nl81EqOrI0goTQJ6ww7koXXyqqGphcZvnw2T:i9D+81EDmAQVwIoYnhnHT

Score

10^/10

guloader discovery downloader

Malware Config

Targets

- Target
  
  30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe
- Size
  
  136KB
- MD5
  
  82c4a21d4ca4a085260dd4b6dc07b258
- SHA1
  
  d115a2668ec1acec9e652387e9ee04ce39e1ff73
- SHA256
  
  30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3
- SHA512
  
  4f23d20c5ccaadc998bceeee3c8e86d2cba427ed7d3b6e9278c3ba3790d3b7530ab9be2ac1db4e5a8e401ea0f13500b08ce47cbea2c01fd66d0c526d6e1a8f0f
- SSDEEP
  
  1536:7uQk9P70nl81EqOrI0goTQJ6ww7koXXyqqGphcZvnw2T:i9D+81EDmAQVwIoYnhnHT
Score

10^/10

guloader discovery downloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderdiscoverydownloader

behavioral2

guloaderdiscoverydownloader