guloader | 777441225b9d294baca2f689286a1f70a0fc28007e86cf1cc099c71ee1d826f2 | Triage

Sharing

General

Target

777441225b9d294baca2f689286a1f70a0fc28007e86cf1cc099c71ee1d826f2
Size

777KB
Sample

241211-xs49psvlhw
MD5

82ba32e4800897e8bafb32990d29f60a
SHA1

21b724df29b7ddbcd88849e7ad6ab12a4d266c4c
SHA256

777441225b9d294baca2f689286a1f70a0fc28007e86cf1cc099c71ee1d826f2
SHA512

7e741fab4e31223a967c4194f31e4fd592b75dc14dde4c72c3fbd5efb28f312807f886290fa8a227037890375d3ada7597857138f4df4d905b0ae4ca7b906101
SSDEEP

12288:UXqlVfD6qKMwy8kjKsge8jLAMsnI8c78pc+HeV4PRklT3we+doWVkeehown:UXqzrTK5XsgervnIac+Hm4QT31V1hown

Score

10^/10

guloader discovery downloader execution

Malware Config

Targets

- Target
  
  777441225b9d294baca2f689286a1f70a0fc28007e86cf1cc099c71ee1d826f2
- Size
  
  777KB
- MD5
  
  82ba32e4800897e8bafb32990d29f60a
- SHA1
  
  21b724df29b7ddbcd88849e7ad6ab12a4d266c4c
- SHA256
  
  777441225b9d294baca2f689286a1f70a0fc28007e86cf1cc099c71ee1d826f2
- SHA512
  
  7e741fab4e31223a967c4194f31e4fd592b75dc14dde4c72c3fbd5efb28f312807f886290fa8a227037890375d3ada7597857138f4df4d905b0ae4ca7b906101
- SSDEEP
  
  12288:UXqlVfD6qKMwy8kjKsge8jLAMsnI8c78pc+HeV4PRklT3we+doWVkeehown:UXqzrTK5XsgervnIac+Hm4QT31V1hown
Score

10^/10

discovery execution guloader downloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

guloaderdiscoverydownloaderexecution