Overview

overview

10

Static

static

3

RFQ_048755...78.exe

windows7-x64

7

RFQ_048755...78.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

InFAudioRi...er.dll

windows7-x64

3

InFAudioRi...er.dll

windows10-2004-x64

3

Styrelsesc...ng.dll

windows7-x64

3

Styrelsesc...ng.dll

windows10-2004-x64

3

lang-1065.dll

windows7-x64

1

lang-1065.dll

windows10-2004-x64

1

minidump-analyzer.exe

windows7-x64

minidump-analyzer.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_93d1cfc1144a770d979ce7eaaa745f3e627d3af2b08b3e09bdbd4fbb7329a744

  • Size

    749KB

  • Sample

    241229-gxz8jsvmct

  • MD5

    ce70e59692efb3e486c1dfb19f22f76d

  • SHA1

    7c2b4ab186ba5ca2ca9dfba2bc884a38b84d567a

  • SHA256

    93d1cfc1144a770d979ce7eaaa745f3e627d3af2b08b3e09bdbd4fbb7329a744

  • SHA512

    ed3eb6a685fa1d6dd107b283c7a4e0b8f9337ad1b362dc3eecfa9a3149871c2bcb77ee95c1779a21149bfb23ed2194b04ada304325f1cc77c4a2c13ee7838eb1

  • SSDEEP

    12288:GiSECsND8A77tJGCRGEmKVvVZPl/I4Su55+i66tJc1YslC09RFJ23Jr:TRDvJNHbVvnFIZ68N/FJ23Jr

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      RFQ_0487556789765678.bin

    • Size

      891KB

    • MD5

      c40baf8d9d47b9c4a2275db7c3e2ab52

    • SHA1

      8f9cdb9f78fe31f72ff01efbbd549a29c4c642f5

    • SHA256

      856888dc7dad77cfd55ce59da31a1f2648d6bdb9972183c8233529145d39240f

    • SHA512

      762c863ee918837d5b9438f919e10fd5ce881aa5bb4633fb882a87f34164db37b00b089f12d80d65c1f9076e19d18342b6da8ca5700ab5ef14d90adb60f83b0b

    • SSDEEP

      24576:G9KQDGLersCUfvmWSH1YvgnMu1xygATZ0wNrcMfcVLCN:eDhABuxHeiT/yTZnZt

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      792b6f86e296d3904285b2bf67ccd7e0

    • SHA1

      966b16f84697552747e0ddd19a4ba8ab5083af31

    • SHA256

      c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

    • SHA512

      97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c

    • SSDEEP

      192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      InFAudioRippingServer.dll

    • Size

      429KB

    • MD5

      28d7c03d8da1686dce08093537386262

    • SHA1

      48d947f01441ff7d93d1b467326832dab5693c4c

    • SHA256

      4c7737d91e2cce7e7dc114ed744c39927592df4c48b9b5192682567b94cb4dd1

    • SHA512

      f4c48ad88c9595c2ef50656a736b4f5b8f33af2c316b95fdd10854a20f94411e835caf571c536ffe5d7ece9591ffa1ca0893291ce647ef087b77c5cfba5766a6

    • SSDEEP

      6144:i8kI4V6J4rUHMt/B9JlkRCiOV7fkKafdik402vE34:pkI4QdMt/B9JlkYijKa0fp

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      Styrelseschefer207/Forsvarsministerniveau/AsMultiLang.dll

    • Size

      216KB

    • MD5

      7fb99bb09cf9199c566160936b26ce2d

    • SHA1

      589aed17d4410ab733373b9d57d961f2c0340d2b

    • SHA256

      fa41d404bc28b870d4f753f45f73d54f6a0f92001746020ecb7bca4788a743cb

    • SHA512

      2f90ef96e2b813d869b54f13b36719f0f23489d4dc0b531ac40e480b47e87c75abb3deb30e94edc07548946fe6896ae3763b7746e79a4d60619ffd040cf567b2

    • SSDEEP

      3072:xcYkT/6R/iR+vWBUa3wmbM8Sz/aM1QqjXJuSpL7Hlwr736x6TtNrwTYj+:SORi+vWBT3jb66b5zrn

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      lang-1065.dll

    • Size

      154KB

    • MD5

      dc03895948698a2ad5a33d0413ddc640

    • SHA1

      37c4da3b4a22f44fa8da7afaf5d7eaab65a4d6b7

    • SHA256

      c3554b1a82dacabc078663f21cdc9a791c45c4ce6a244462367c949029cf37d5

    • SHA512

      2e846c9acca0647b8937f7b3e928eca4e5eebefc66f6301d8f3514f573337e378b2f2da47c1160717f03650d697c4fe25bb1fed04704fbb873435ccb1cff2d7d

    • SSDEEP

      1536:TjvODwgrP18Y8bYSQwuFlWI279w1/hjW2Od8X16KSd:3v6wgrt8Y8bYSNuFEPw1bOm1M

    Score
    1/10
    behavioral10behavioral9

    • Target

      minidump-analyzer.exe

    • Size

      753KB

    • MD5

      6441567d39f3c1eab23044f7b0c9bb3b

    • SHA1

      922a103c5f39775ed7da2cb518772a28a854e97d

    • SHA256

      0ae3105a9ed8acfc348829541776c15901d8625074c9c1a5eba265447137f48e

    • SHA512

      812ea816b586464ef16bda8c8835a7d0114602ce44ebc171ca82853b81851f97e75fc03904d6f99baa07ec1278ca158afd7c023aba55ebe4139268ad6131a0ae

    • SSDEEP

      6144:fnR8X9OdYCYQaqkk4goT9kDaZUqSc/i7yJuAT6ZEWmYz+v7GOpagX:vEMhTaqksm9OgZ/NUAXWmBv7r

    Score
    1/10
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks