Overview

overview

10

Static

static

3

249717850-...df.exe

windows7-x64

10

249717850-...df.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    249717850-05033354343-sanlccjavap0003-9944.pdf.exe

  • Size

    654KB

  • Sample

    250203-hd6fwsvpfr

  • MD5

    8ca0850e98f3ab5a266476284ea95ccd

  • SHA1

    5db5447f48a5930e64ac74ae2705ef1c8b6d026b

  • SHA256

    ede9c2e040ea3565b87ddcd32989167ff2f8bd23c31b9a45f446fc6b17fb5370

  • SHA512

    de6b01679e9c2c9bfe7f43572f9c981e5155adbd6efcfce38d36fe3500424ecb6a69b9284ac767200bdcd3c9d72f032bb75825b0c47de990947e0e580b99f39d

  • SSDEEP

    12288:Cgum6gVzk7S3NGnOtwgv99L3tqQLRvqcT1ENY54Tob:BVom3NGngF9MmvqcpCYIob

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      249717850-05033354343-sanlccjavap0003-9944.pdf.exe

    • Size

      654KB

    • MD5

      8ca0850e98f3ab5a266476284ea95ccd

    • SHA1

      5db5447f48a5930e64ac74ae2705ef1c8b6d026b

    • SHA256

      ede9c2e040ea3565b87ddcd32989167ff2f8bd23c31b9a45f446fc6b17fb5370

    • SHA512

      de6b01679e9c2c9bfe7f43572f9c981e5155adbd6efcfce38d36fe3500424ecb6a69b9284ac767200bdcd3c9d72f032bb75825b0c47de990947e0e580b99f39d

    • SSDEEP

      12288:Cgum6gVzk7S3NGnOtwgv99L3tqQLRvqcT1ENY54Tob:BVom3NGngF9MmvqcpCYIob

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      0c44f21d4afc81cc99fac7cc35e4503a

    • SHA1

      3d0d5c684df99a46510c0e2c0020163a9d11c08d

    • SHA256

      8dc2be6679497994e3ddc97bc7bc1ce2b3c17ef3528b03ded6696ef198a11d10

    • SHA512

      4e4bd35d6aa21cecbfe7a93a2ee7db8ee78ca710a4193dfe240d1067afbe10f61db332c1c85f6cc3ba404d895a959742401b615ef8ff5bd9028254c4a43a0923

    • SSDEEP

      48:S46+/N3TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mCofjLl:zPuPbOBtWZBV8jAWiAJCdv2CmpL

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      a4dd044bcd94e9b3370ccf095b31f896

    • SHA1

      17c78201323ab2095bc53184aa8267c9187d5173

    • SHA256

      2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

    • SHA512

      87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

    • SSDEEP

      192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks