guloader | 05814550e1562d4c54710804145c678b6191aab6a07c73e6f7902b1149bb020d

General

Target

REQUEST FOR QUOATION AND PRICES.exe
Size

717KB
Sample

241203-qfhrlswres
MD5

143edb6c5c1e1a1e06695965f2b5cb74
SHA1

b43660357dbe4c3d84d4239b6273817b5eb1ff53
SHA256

05814550e1562d4c54710804145c678b6191aab6a07c73e6f7902b1149bb020d
SHA512

8656e2e854a66f2901898147303fa5119c691defc06745d38d93ce0ef06ff243d85b8d0d109d0ef18c4bb3b1de29a5c76961b85a77959c0d93b9179546bbe761
SSDEEP

12288:xlYZmcRHOohpeGbzpAbzRglY6y/utl97avDAoXPJO2RpXD3j:UmcdOohMyz5Y6yK7arHXPJOyXjj

Score

10^/10

Malware Config

Targets

- Target
  
  REQUEST FOR QUOATION AND PRICES.exe
- Size
  
  717KB
- MD5
  
  143edb6c5c1e1a1e06695965f2b5cb74
- SHA1
  
  b43660357dbe4c3d84d4239b6273817b5eb1ff53
- SHA256
  
  05814550e1562d4c54710804145c678b6191aab6a07c73e6f7902b1149bb020d
- SHA512
  
  8656e2e854a66f2901898147303fa5119c691defc06745d38d93ce0ef06ff243d85b8d0d109d0ef18c4bb3b1de29a5c76961b85a77959c0d93b9179546bbe761
- SSDEEP
  
  12288:xlYZmcRHOohpeGbzpAbzRglY6y/utl97avDAoXPJO2RpXD3j:UmcdOohMyz5Y6yK7arHXPJOyXjj
Score

10^/10

guloader discovery downloader evasion spyware stealer collection
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Disables Task Manager via registry modification
  evasion
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fc90dfb694d0e17b013d6f818bce41b0
- SHA1
  
  3243969886d640af3bfa442728b9f0dff9d5f5b0
- SHA256
  
  7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
- SHA512
  
  324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
- SSDEEP
  
  192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
Score

3^/10

discovery
behavioral3 behavioral4