guloader | ec0c8d7a3312e95aa25f0ce8dd738ed1660246374f6a6d1a268b97ae4d3c4d47

General

Target

ec0c8d7a3312e95aa25f0ce8dd738ed1660246374f6a6d1a268b97ae4d3c4d47.exe
Size

760KB
Sample

250111-gjc6vszlfq
MD5

8f02b3e31021d64ed25a599e58bc8f2f
SHA1

7bec44b33d33f11de7f626097b70758f60f655f5
SHA256

ec0c8d7a3312e95aa25f0ce8dd738ed1660246374f6a6d1a268b97ae4d3c4d47
SHA512

d16554484647d2875b0bcf4b84c7726b14cd96725ba562be2f06714d80468367ecbdfd251c20eee5cd0220fba15becc9c53ccd42fe1110699fe2eb43813fb142
SSDEEP

12288:xlYZmcRHOg1BFC+gpurATKGOCDUYRpRlUcRzhPnxd2ckxkYJLY:UmcdOOBRg00W4YYJlUcR1vxdgxk2LY

Score

10^/10

Malware Config

Targets

- Target
  
  ec0c8d7a3312e95aa25f0ce8dd738ed1660246374f6a6d1a268b97ae4d3c4d47.exe
- Size
  
  760KB
- MD5
  
  8f02b3e31021d64ed25a599e58bc8f2f
- SHA1
  
  7bec44b33d33f11de7f626097b70758f60f655f5
- SHA256
  
  ec0c8d7a3312e95aa25f0ce8dd738ed1660246374f6a6d1a268b97ae4d3c4d47
- SHA512
  
  d16554484647d2875b0bcf4b84c7726b14cd96725ba562be2f06714d80468367ecbdfd251c20eee5cd0220fba15becc9c53ccd42fe1110699fe2eb43813fb142
- SSDEEP
  
  12288:xlYZmcRHOg1BFC+gpurATKGOCDUYRpRlUcRzhPnxd2ckxkYJLY:UmcdOOBRg00W4YYJlUcR1vxdgxk2LY
Score

10^/10

guloader discovery downloader evasion spyware stealer collection
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Disables Task Manager via registry modification
  evasion
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fc90dfb694d0e17b013d6f818bce41b0
- SHA1
  
  3243969886d640af3bfa442728b9f0dff9d5f5b0
- SHA256
  
  7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
- SHA512
  
  324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
- SSDEEP
  
  192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
Score

3^/10

discovery
behavioral3 behavioral4