guloader | b2289f30e7ca8d3b6fadabba406a2071fbdb318ddfe1f06389e5295775cc8d7c | Triage

Sharing

General

Target

b2289f30e7ca8d3b6fadabba406a2071fbdb318ddfe1f06389e5295775cc8d7c.exe
Size

672KB
Sample

241124-ft6qgsvrhw
MD5

3a839bf48b4672cea07c7d5f49f70f8d
SHA1

d4ac0b8f932bc67d0eac1f75a49339136921b1d4
SHA256

b2289f30e7ca8d3b6fadabba406a2071fbdb318ddfe1f06389e5295775cc8d7c
SHA512

15461440c8dc6a6d966fcade3381f4c94c34d2acdd38f5fa6a7925589a18c5c430ffc88c084ab5c602a6dce725d3b400b8481c3fbcc3da4cc22ea5d10742394a
SSDEEP

12288:JiNLrUt25WKlGHlkn+Ff6AUeLZAyCOE5PNW0FLTrx:JiNAtiWKlGO+FEemy85V9Fzx

Score

10^/10

guloader discovery downloader persistence

Malware Config

Targets

- Target
  
  b2289f30e7ca8d3b6fadabba406a2071fbdb318ddfe1f06389e5295775cc8d7c.exe
- Size
  
  672KB
- MD5
  
  3a839bf48b4672cea07c7d5f49f70f8d
- SHA1
  
  d4ac0b8f932bc67d0eac1f75a49339136921b1d4
- SHA256
  
  b2289f30e7ca8d3b6fadabba406a2071fbdb318ddfe1f06389e5295775cc8d7c
- SHA512
  
  15461440c8dc6a6d966fcade3381f4c94c34d2acdd38f5fa6a7925589a18c5c430ffc88c084ab5c602a6dce725d3b400b8481c3fbcc3da4cc22ea5d10742394a
- SSDEEP
  
  12288:JiNLrUt25WKlGHlkn+Ff6AUeLZAyCOE5PNW0FLTrx:JiNAtiWKlGO+FEemy85V9Fzx
Score

10^/10

guloader discovery downloader persistence
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  d968cb2b98b83c03a9f02dd9b8df97dc
- SHA1
  
  d784c9b7a92dce58a5038beb62a48ff509e166a0
- SHA256
  
  a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
- SHA512
  
  2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
- SSDEEP
  
  192:CVA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:CrR7SrtTv53tdtTgwF4SQbGPX36wJMw
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderdiscoverydownloaderpersistence

behavioral2

guloaderdiscoverydownloaderpersistence

behavioral3

behavioral4