Overview

overview

10

Static

static

3

df4f955eb7...2f.exe

windows7-x64

7

df4f955eb7...2f.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df4f955eb7e72870bf18d39f3dfe1fad5fb9093a080e65f315d215bfec94cc2f.exe

  • Size

    1.0MB

  • Sample

    250110-r5bv2azlbq

  • MD5

    57a8326258e722638fdfab7715e94356

  • SHA1

    ae16c7ecb431ad5775bd0b00c39117756431422b

  • SHA256

    df4f955eb7e72870bf18d39f3dfe1fad5fb9093a080e65f315d215bfec94cc2f

  • SHA512

    9fbf9f21a79a7b02aeb4a51c54394a67ed9d394b0895c4c6f3c9022e6631c1f66f63e2df0eefcbd64164e9b949a001746bf14c2648dfd2f691e673d62cf2b8a3

  • SSDEEP

    24576:9jwKCNucluh8HfWRd7aEIRYO0sCaHfToikFhZD1fJAj1:V1CVqyfi7a2O0RniAZD/a1

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      df4f955eb7e72870bf18d39f3dfe1fad5fb9093a080e65f315d215bfec94cc2f.exe

    • Size

      1.0MB

    • MD5

      57a8326258e722638fdfab7715e94356

    • SHA1

      ae16c7ecb431ad5775bd0b00c39117756431422b

    • SHA256

      df4f955eb7e72870bf18d39f3dfe1fad5fb9093a080e65f315d215bfec94cc2f

    • SHA512

      9fbf9f21a79a7b02aeb4a51c54394a67ed9d394b0895c4c6f3c9022e6631c1f66f63e2df0eefcbd64164e9b949a001746bf14c2648dfd2f691e673d62cf2b8a3

    • SSDEEP

      24576:9jwKCNucluh8HfWRd7aEIRYO0sCaHfToikFhZD1fJAj1:V1CVqyfi7a2O0RniAZD/a1

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks