guloader | e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa | Triage

Sharing

General

Target

e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa.exe
Size

571KB
Sample

250110-rwallsyqgj
MD5

9bb2cdb8508ee2255a35ecec43462a48
SHA1

c7465e8b0a3ae61b23520752afbb8bf89a3cecdd
SHA256

e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa
SHA512

0b8e8399eb04372c1cb70467dca25078ab255d01c448fa7ccabd620d9066306a1127c4e5caa4af66226662bb3b2d143045b9212332e7408c7b97ea40672a0ac1
SSDEEP

12288:ifYfUlNHYh6EEfqUhn5i5mfQAsS+6ePZxIgLF7eEbH+aj:ifYMPYcqUhY5mp9+6ehxIg5H9j

Score

10^/10

guloader discovery downloader

Malware Config

Targets

- Target
  
  e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa.exe
- Size
  
  571KB
- MD5
  
  9bb2cdb8508ee2255a35ecec43462a48
- SHA1
  
  c7465e8b0a3ae61b23520752afbb8bf89a3cecdd
- SHA256
  
  e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa
- SHA512
  
  0b8e8399eb04372c1cb70467dca25078ab255d01c448fa7ccabd620d9066306a1127c4e5caa4af66226662bb3b2d143045b9212332e7408c7b97ea40672a0ac1
- SSDEEP
  
  12288:ifYfUlNHYh6EEfqUhn5i5mfQAsS+6ePZxIgLF7eEbH+aj:ifYMPYcqUhY5mp9+6ehxIg5H9j
Score

10^/10

discovery guloader downloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  192639861e3dc2dc5c08bb8f8c7260d5
- SHA1
  
  58d30e460609e22fa0098bc27d928b689ef9af78
- SHA256
  
  23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- SHA512
  
  6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP
  
  192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

guloaderdiscoverydownloader

behavioral3

behavioral4