Overview

overview

10

Static

static

3

Sigmanly_9...fa.exe

windows7-x64

10

Sigmanly_9...fa.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sigmanly_9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa

  • Size

    562KB

  • Sample

    250203-tv2d2sxrcn

  • MD5

    ac95b030d070152383d1e7cb8848c666

  • SHA1

    ecc1e3bbfb34901f7318f53bbf6a0de5ed7f2c13

  • SHA256

    9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa

  • SHA512

    f02a84ebe21348452b5ba67762f1ea3b3915a4b1e5a10d3cfa6b456371861384be5abc60123798371a92a59f5fd3ce1a0ee5f3c00e527110ee9e95d8ce087bb2

  • SSDEEP

    12288:1k2kjT6WanMG0UCcmhcz218oAm3R3W6TRVZdMNd/:+T6BMSCcmv18oRR1ZdM7

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      Sigmanly_9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa

    • Size

      562KB

    • MD5

      ac95b030d070152383d1e7cb8848c666

    • SHA1

      ecc1e3bbfb34901f7318f53bbf6a0de5ed7f2c13

    • SHA256

      9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa

    • SHA512

      f02a84ebe21348452b5ba67762f1ea3b3915a4b1e5a10d3cfa6b456371861384be5abc60123798371a92a59f5fd3ce1a0ee5f3c00e527110ee9e95d8ce087bb2

    • SSDEEP

      12288:1k2kjT6WanMG0UCcmhcz218oAm3R3W6TRVZdMNd/:+T6BMSCcmv18oRR1ZdM7

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      f1e9eed02db3a822a7ddef0c724e5f1f

    • SHA1

      65864992f5b6c79c5efbefb5b1354648a8a86709

    • SHA256

      6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df

    • SHA512

      c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c

    • SSDEEP

      48:S46+/fTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mjsofjLl:zRuPbOBtWZBV8jAWiAJCdv2Cmj/L

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      17ed1c86bd67e78ade4712be48a7d2bd

    • SHA1

      1cc9fe86d6d6030b4dae45ecddce5907991c01a0

    • SHA256

      bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

    • SHA512

      0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

    • SSDEEP

      192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks