guloader | 8250c1a738d87ed5e8f7d743fa4b523a8c662c568f97b05de5712e9f2c39c647

General

Target

8250c1a738d87ed5e8f7d743fa4b523a8c662c568f97b05de5712e9f2c39c647.exe
Size

737KB
Sample

241205-dag7ns1jdp
MD5

eb15bbefe683ef09c1c5c1bf5068dd71
SHA1

0b613412103c088372fb19656152d21d6a5db027
SHA256

8250c1a738d87ed5e8f7d743fa4b523a8c662c568f97b05de5712e9f2c39c647
SHA512

efc5e6c51a7d815294bf6de694803165c7e56e456e1cf350539e0299f66af3d5dc346bd5d98df151f51ee4fd35dccad98a113d22354f6cae4cbf0d31d823c45f
SSDEEP

12288:xlYZmcRHOys4LnDPb/RNXcIYSBZZKS2vHll7Q9hSCjJgroHaPdl7Fh:UmcdOt4LrXcAvKSErsOk+rddd3

Score

10^/10

Malware Config

Targets

- Target
  
  8250c1a738d87ed5e8f7d743fa4b523a8c662c568f97b05de5712e9f2c39c647.exe
- Size
  
  737KB
- MD5
  
  eb15bbefe683ef09c1c5c1bf5068dd71
- SHA1
  
  0b613412103c088372fb19656152d21d6a5db027
- SHA256
  
  8250c1a738d87ed5e8f7d743fa4b523a8c662c568f97b05de5712e9f2c39c647
- SHA512
  
  efc5e6c51a7d815294bf6de694803165c7e56e456e1cf350539e0299f66af3d5dc346bd5d98df151f51ee4fd35dccad98a113d22354f6cae4cbf0d31d823c45f
- SSDEEP
  
  12288:xlYZmcRHOys4LnDPb/RNXcIYSBZZKS2vHll7Q9hSCjJgroHaPdl7Fh:UmcdOt4LrXcAvKSErsOk+rddd3
Score

10^/10

guloader discovery downloader evasion spyware stealer collection
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Disables Task Manager via registry modification
  evasion
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fc90dfb694d0e17b013d6f818bce41b0
- SHA1
  
  3243969886d640af3bfa442728b9f0dff9d5f5b0
- SHA256
  
  7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
- SHA512
  
  324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
- SSDEEP
  
  192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
Score

3^/10

discovery
behavioral3 behavioral4