guloader | 5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44

General

Target
5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44.exe
Size 553KB
Sample241126-c3c8rawnhj
SHA256 5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44
MD5 d4c19e96d83bd586016a3be2e3a57f1d
SHA1 bf5d7271766db9b568ac98006c7eda0de40bc2bd
SHA512 03078c41d61c02c1f8f7d34c4b93ac4d534a26c4d3dd28c04102d7f10b2eecea6499b38e0a87db0447314b3ca1f097f02d1c7ebd5d3fa994d9708d86df9f9c62
SSDEEP 12288:32EIMY+ov3ZXExuA5lpKHHtmZxxNQicmd3ZhZF:3w9+U36t5lAnoZxbcmdPZF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

Targets

- Target
  5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44.exe
- Size 553KB
- SHA256 5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44
- MD5 d4c19e96d83bd586016a3be2e3a57f1d
- SHA1 bf5d7271766db9b568ac98006c7eda0de40bc2bd
- SHA512 03078c41d61c02c1f8f7d34c4b93ac4d534a26c4d3dd28c04102d7f10b2eecea6499b38e0a87db0447314b3ca1f097f02d1c7ebd5d3fa994d9708d86df9f9c62
- SSDEEP 12288:32EIMY+ov3ZXExuA5lpKHHtmZxxNQicmd3ZhZF:3w9+U36t5lAnoZxbcmdPZF
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer collection spyware
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- MD5 75ed96254fbf894e42058062b4b4f0d1
- SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
- SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4