guloader | dd37002352fdc8e8a56a23ea19ba146f907d3d807f1ac0131954cf0922a2a100

General

Target
dd37002352fdc8e8a56a23ea19ba146f907d3d807f1ac0131954cf0922a2a100
Size 530KB
Sample241208-ebyrgswmak
SHA256 dd37002352fdc8e8a56a23ea19ba146f907d3d807f1ac0131954cf0922a2a100
MD5 67d75bb670fc40d5a7b404bc55fed626
SHA1 e1e084cf07b55f06d7e03d815ca0e0a4775333e7
SHA512 b045020b63bc8728f431e10ba273fdbe2658c9efc325ab75dd31ac83d343d51925bde26fec7ae9b4eaef343ed311442930e8710344c36994327d8fe800453952
SSDEEP 12288:kcAVddRgtwamaqxOUrIj15nW5jf8zHaM9I31BiXEHnW:Sddiz0OAY5nW5jf82ziXE2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  dd37002352fdc8e8a56a23ea19ba146f907d3d807f1ac0131954cf0922a2a100
- Size 530KB
- SHA256 dd37002352fdc8e8a56a23ea19ba146f907d3d807f1ac0131954cf0922a2a100
- MD5 67d75bb670fc40d5a7b404bc55fed626
- SHA1 e1e084cf07b55f06d7e03d815ca0e0a4775333e7
- SHA512 b045020b63bc8728f431e10ba273fdbe2658c9efc325ab75dd31ac83d343d51925bde26fec7ae9b4eaef343ed311442930e8710344c36994327d8fe800453952
- SSDEEP 12288:kcAVddRgtwamaqxOUrIj15nW5jf8zHaM9I31BiXEHnW:Sddiz0OAY5nW5jf82ziXE2
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
- MD5 b8992e497d57001ddf100f9c397fcef5
- SHA1 e26ddf101a2ec5027975d2909306457c6f61cfbd
- SHA512 8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c
- SSDEEP 192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader family

Guloader,Cloudeye

Loads dropped DLL

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4