Overview

overview

10

Static

static

3

WTF.exe

windows7-x64

10

WTF.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9ac04c980e1d877c558fc9218766386ec896bcce2d675cd25ecaa74b990b08fa

  • Size

    194KB

  • Sample

    241224-lr8d7avjdl

  • MD5

    71753224f465baa97517d1b440b7b35b

  • SHA1

    43af57caa138a3352ac2c1c914e536d56423a68f

  • SHA256

    9ac04c980e1d877c558fc9218766386ec896bcce2d675cd25ecaa74b990b08fa

  • SHA512

    d6912f7827ddbcb7f4e794a0914dc3741e0d69b4e5759b434d12ea08dc865d7b076db13eed09d568fa696627c1d539e59aa1e6aeb23775ad12d8e8b66349a998

  • SSDEEP

    6144:KK8u2YFECxhoW2+XLtKPAV7dFwir7QjGrXguoz:KKOYFECjoWPX7nwir7QjGrwuS

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      WTF.exe

    • Size

      344KB

    • MD5

      9b3059448f3fa6da827ef925f9f86e33

    • SHA1

      9854bd2c791a99d6409c66ea0f5806d615720e20

    • SHA256

      8e9488d20c505541485cbaf7a2716c0567512de6f3f87bb34b5ddc87a0fe78b9

    • SHA512

      f74f8dfe9f88ffc69e0d71c442b6195640a145da11c7d2bca5529710fa8fed2355d63e68e160f991a8c9d822561ce7e0d518a0075ef48710be3b24b26ea5cda0

    • SSDEEP

      6144:IbE/HU7YLR1SIk6HRa5fjt/iW3DIM4xIhM1IiQ/q+A9TgOCkjMJCRu0Wp3Ww:IbALvSCHWf1tiQC+A9Tbz03Ww

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks