guloader | b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24

General

Target
b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24.exe
Size 629KB
Sample241126-drdktaxreq
SHA256 b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24
MD5 ea3570960a117b551ef4d63afb90594a
SHA1 25e8d6660e6bdf88c78a484ecc49f1f5e862902d
SHA512 822fd9ae05be68403868ce69aa9944b90d6a3285c8a17d1009cccff02ebd2bc10dc6434cb0473a3e5a5c58c849e3dee112819bf5a6ca395d3447eba65f11d076
SSDEEP 12288:2ZPsXk8zK2u+4rYnH12g+ohTHPU66swKpUHsTx6I+0X:CWhu6H1ZtFPU9skMTxX+0X
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24.exe
- Size 629KB
- SHA256 b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24
- MD5 ea3570960a117b551ef4d63afb90594a
- SHA1 25e8d6660e6bdf88c78a484ecc49f1f5e862902d
- SHA512 822fd9ae05be68403868ce69aa9944b90d6a3285c8a17d1009cccff02ebd2bc10dc6434cb0473a3e5a5c58c849e3dee112819bf5a6ca395d3447eba65f11d076
- SSDEEP 12288:2ZPsXk8zK2u+4rYnH12g+ohTHPU66swKpUHsTx6I+0X:CWhu6H1ZtFPU9skMTxX+0X
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery guloader downloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader family

Guloader,Cloudeye

Loads dropped DLL

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4