guloader | cb076958b9db298f34a9eeaafc4796f6d902b19b1696b76179db10612d371608

General

Target

Request for Quotation New collaboration.exe
Size

710KB
Sample

241209-jbt6hsvrem
MD5

1e4847dd3c262a4303261601f0197a42
SHA1

eaa9a7dbdf8211dbe248b739480e349c0fb56583
SHA256

cb076958b9db298f34a9eeaafc4796f6d902b19b1696b76179db10612d371608
SHA512

76620c6decf9b5ae48ddf5eda391081d568a0de7e6d87c814040614000d9b1f989466ec8a8ea9395dd45ea927a77c2f3bc848bf8910ad578bef31299801b312d
SSDEEP

12288:xlYZmcRHOAXnPlX1V6loPrHA8P4xq0xnVBTjJ:UmcdOA3PlXularHbP4xfxPJ

Score

10^/10

Malware Config

Targets

- Target
  
  Request for Quotation New collaboration.exe
- Size
  
  710KB
- MD5
  
  1e4847dd3c262a4303261601f0197a42
- SHA1
  
  eaa9a7dbdf8211dbe248b739480e349c0fb56583
- SHA256
  
  cb076958b9db298f34a9eeaafc4796f6d902b19b1696b76179db10612d371608
- SHA512
  
  76620c6decf9b5ae48ddf5eda391081d568a0de7e6d87c814040614000d9b1f989466ec8a8ea9395dd45ea927a77c2f3bc848bf8910ad578bef31299801b312d
- SSDEEP
  
  12288:xlYZmcRHOAXnPlX1V6loPrHA8P4xq0xnVBTjJ:UmcdOA3PlXularHbP4xfxPJ
Score

10^/10

guloader discovery downloader evasion spyware stealer collection
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Disables Task Manager via registry modification
  evasion
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fc90dfb694d0e17b013d6f818bce41b0
- SHA1
  
  3243969886d640af3bfa442728b9f0dff9d5f5b0
- SHA256
  
  7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
- SHA512
  
  324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
- SSDEEP
  
  192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
Score

3^/10

discovery
behavioral3 behavioral4