Overview

overview

10

Static

static

3

Trommehvirvlens.exe

windows7-x64

10

Trommehvirvlens.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Simultanto...-7.dll

windows7-x64

1

Simultanto...-7.dll

windows10-2004-x64

1

Simultanto...0.html

windows7-x64

3

Simultanto...0.html

windows10-2004-x64

3

VirtualDri...in.dll

windows7-x64

1

VirtualDri...in.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_92cafb69e4d5cca29a5360fe961db181158bda0605083d08ef96dac8c2c6b61b

  • Size

    391KB

  • Sample

    241228-3j53javrek

  • MD5

    b21539cfadcc8b418c64793f0c7264f7

  • SHA1

    166e9798a26ccaf9a0ee754808717651d785e7d9

  • SHA256

    92cafb69e4d5cca29a5360fe961db181158bda0605083d08ef96dac8c2c6b61b

  • SHA512

    89cd6a729c2150d8d4ba50d31b1c6f0a1f319c33b199a998999815a80fc6a6fb08b64961d3c7b1358b6c540f63a384b9ee59ef5e2d9ec1dae9a9301e291cf843

  • SSDEEP

    6144:wGMbROzLrZf9xD0ne1n66I0+0Cyk87H5+pmVXienkcQbOuWWWynQUYV8SPd:M4zLrZf0o66r+B87ZhV3kclZBd

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      Trommehvirvlens.exe

    • Size

      522KB

    • MD5

      4dd1f0568d31577fada5d3da343270d1

    • SHA1

      ca7197ff70d4cbbb8443a3bf912ec5ae9349bf3c

    • SHA256

      b531a9e5b9ba3e10ec2ac3428e0a9835b9468943580df0894483ee9a91377294

    • SHA512

      bcd0e2f74309fc8f22c7fb573079748d26007c988a503dbdad9ced2510564e5cff427c58fa050409994c07d7e7fc320b39612226bd6bd2f923d57098b4be4043

    • SSDEEP

      12288:hqNMEh6Pdf3GrlJsH6QH9QoJdp9e4sEYnYH/qO8:WMldW5JsHpqY9e4sEYYH/6

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      a4dd044bcd94e9b3370ccf095b31f896

    • SHA1

      17c78201323ab2095bc53184aa8267c9187d5173

    • SHA256

      2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

    • SHA512

      87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

    • SSDEEP

      192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Simultantolke/Sydhavss211/Stopventils/libffi-7.dll

    • Size

      29KB

    • MD5

      43c639b6ba8415f94b8fc27a96042650

    • SHA1

      07ed717e5032f2025f759ef484fc25178922768c

    • SHA256

      d07afee9199e6cbf406f7e6a7f9673296bda5244e5ca79a37177226f12801d35

    • SHA512

      eeadc1f19a633ab2b05c4466de6d35cfb7c76a731d8ac23e5cbf7005ed905874c43bfc6f5da9aeeab66aad00584862df691e7ae8e5da805ee1d9608cb6663b0d

    • SSDEEP

      384:PC9/Hckzur4W7phM9EsXbD37e9t8TlfJJD+QiUZ5ZqtIsNYF5VYJO0mnwrRCXWxU:q9UkeXMNXbD37e9LUZfqtkLVYJXuWc

    Score
    1/10
    behavioral5behavioral6

    • Target

      Simultantolke/Sydhavss211/Stopventils/libxml2-2.0.typelib

    • Size

      1KB

    • MD5

      5343c1a8b203c162a3bf3870d9f50fd4

    • SHA1

      04b5b886c20d88b57eea6d8ff882624a4ac1e51d

    • SHA256

      dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

    • SHA512

      e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      VirtualDrivePlugin.dll

    • Size

      171KB

    • MD5

      58191dc480408e1da04efa28a574d4e2

    • SHA1

      e860300e6bd68da86cc3760c5d598f9aaf2e5f70

    • SHA256

      45298d418f62ff78dc1a8319eed11e040ceb387a6e3d28105a475217a5ae011c

    • SHA512

      913bbfe3c0382221fb74b25b807d391d1e51eb234c96dfbc0151a73a9931fb5ec6bc5d0fb90e7127faafbc92a1b10c04f4af9831db2d78e8e1a4c322f70aabe5

    • SSDEEP

      3072:QoIzT0RZbPnVNabCBXGtUuRaFOu6Ct9KvapdJ1sFa98N0Su:QoIzT0nPVNac7uRaFOJCt9Kvap7ca9gS

    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Tasks