Overview

overview

10

Static

static

3

makave (2)...B0.exe

windows7-x64

10

makave (2)...B0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    quotation.iso

  • Size

    112KB

  • Sample

    241221-dkw4ks1phn

  • MD5

    6aef1d7f88e8aa450a0c604b4caee5ba

  • SHA1

    3fe45f8cd20cd7c63e55e3918dac1d3a0d7fb05a

  • SHA256

    75fdb848eac332b4ca7d88f497e7ba7ebbb9a798d825b28cf1f87b9d7149e87f

  • SHA512

    f00b960889bea092f26d1cd88bae721d845485b994b943c67b170dea69ac7a56890511c815f11019ba66e1440d251d5efe231dfc0395ecef5ee97bac5f0d2a02

  • SSDEEP

    768:WEdOvsirFVc8suQRjR+DK+QXxoGHdXBplrUeIk:XisiSFjR1BdHdXBfp

Score
10/10
guloaderdiscoverydownloader

Malware Config

Extracted

Family

guloader

C2

https://onedrive.live.com/download?cid=674027E0093531EF&resid=674027E0093531EF%21115&authkey=AGjbhIm6m1Nvx-w

xor.base64

Targets

    • Target

      makave (2)_protected_68A4BB0.exe

    • Size

      52KB

    • MD5

      d6e2c068e30e1c6bc6aa27368930c12c

    • SHA1

      2582f973de8c840192d55bd144d65c0a4d475247

    • SHA256

      f74d3364ef9d3e3df4173a7f12d48348af44bf150c0ffcd01f0054e86ebb7e0e

    • SHA512

      f0d4aa83f6779f550b6a88a2b8b9459d92961190ff1d747c9529919bed7149648ef27c7f205c75465fa843d3c747d9db6e5ede0ef8e231895f1e8dd8010652e9

    • SSDEEP

      768:9dOvsirFVc8suQRjR+DK+QXxoGHdXBplrUeIk:risiSFjR1BdHdXBfp

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks