Overview

overview

10

Static

static

3

Nakliye belgeleri.exe

windows7-x64

10

Nakliye belgeleri.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

hypohydrochloria.app

macos-10.15-amd64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    06122024_1223_06122024_Nakliye belgeleri.gz
  • Size 831KB
  • Sample241206-pkgjnssrbn
  • SHA256 897157add816cce92dbd71702f67356ade3bfe16a405f9c89e7eebeeebbf9ceb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
guloaderdiscoverydownloaderevasionmacos

Malware Config

Targets

    • Target
      Nakliye belgeleri.exe
    • Size 1.1MB
    • SHA256 014f4753734a62111955ca64721aa64a4b6d98b36e5a3bd9a4da5afc128b2f17
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      hypohydrochloria.app
    • Size 487KB
    • SHA256 60412767f4eaea33f06a6a02f3b0975015e75f251ba6cbeee96ac712d0b23f9b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    evasion
    behavioral5

MITRE ATT&CK Enterprise v15

Tasks