Overview

overview

10

Static

static

3

Bakir#.exe

windows7-x64

10

Bakir#.exe

windows10-2004-x64

10

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4E3008DE095B327CE13EE51C27ADB204

  • Size

    491KB

  • Sample

    250204-kq132s1qes

  • MD5

    4e3008de095b327ce13ee51c27adb204

  • SHA1

    996d3af57424d85c6215186a6672e76cc04c7a34

  • SHA256

    850f227ef098450656a0704b5507caba6bd1128de78ffc7ac037a4801716b497

  • SHA512

    9813e31cea237bfe1c738dd76c9aa264d4fb4730c1a80564129aa4d3dcdeb75a128aa442fe623d62fb83f3dd97a0a62dda6b37dac55a0393ab48b523b2cffb65

  • SSDEEP

    12288:Acp/E8MbWy1eJMnwJZucJQZ0hbpY9nYn+6:Ac28MJUJM4xhtYhY+6

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      Bakir#.exe

    • Size

      641KB

    • MD5

      b973b8507af79f55cc863a7a592a41bd

    • SHA1

      d53144ad185aa5587e674a459c782b508b8480fb

    • SHA256

      1c13af8c86d902c0479b21327655caa1be826ac6129f03e61e093d6ec39b0fbe

    • SHA512

      26bd2b1fd356a57919c7daae366bcac5091a56969a42295507e96bcd23ec208941952b94f45d2f20957baa3d23ca4c363b96d5adf93fe3771caff1a363846cd4

    • SSDEEP

      6144:amOPe6H2QcxV+0M7dCy6WeZMnLqJTo+uMJXW30TtbLz3ZST70mw21NKl1+B/nSGc:WA+0MhCyteZMnGJ1uMJm30Jbn291YLWc

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/AdvSplash.dll

    • Size

      6KB

    • MD5

      e8b67a37fb41d54a7eda453309d45d97

    • SHA1

      96be9bf7a988d9cea06150d57cd1de19f1fec19e

    • SHA256

      2ad232bccf4ca06cf13475af87b510c5788aa790785fd50509be483afc0e0bcf

    • SHA512

      20effae18eebb2df90d3186a281fa9233a97998f226f7adead0784fbc787feee419973962f8369d8822c1bbcdfb6e7948d9ca6086c9cf90190c8ab3ec97f4c38

    • SSDEEP

      96:1IUNaXnnXyEIPtXvZhr5RwiULuxDtJ1+wolpE:1Ix3XyEwXvZh1RwnLUDtf+I

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/Banner.dll

    • Size

      4KB

    • MD5

      0d5428f7920274caedfa8f2ae980e196

    • SHA1

      ce2ca2381a4b9ed9f06f6af5a183a840de290c3f

    • SHA256

      4083bef584ad6793b3d57e3e3f764a31afac876412df65c5da5afee76bbd1e10

    • SHA512

      78419752f3e6579f7caf1f9bab70a46ac2b0a7c5f08eb8604e927baea611c182133ce8d58929a059f22e6c2befb5ff0c24ee6500d0708bc884a65e395ea7c4cf

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      376c1b784a3cca9d10ba4ca5d8cb55d2

    • SHA1

      ad12f8ebab5b4b58eb7d5368469e82e2442b089f

    • SHA256

      5bee24fef5c0f643adc7ee02ccb6e80a72a4eb30d9d326023ac03f0ffbc4e624

    • SHA512

      6f02f0d878c228de114dee6b0df85152745b43893a252b2e9c309ba943ea56ab1ee678e42d9b0a89162e2bda627d396c2933c02e1c42d0169ac6e05ff3af4bbb

    • SSDEEP

      48:S46+/pTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mzofjLl:zfuPbOBtWZBV8jAWiAJCdv2CmmL

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      8b3830b9dbf87f84ddd3b26645fed3a0

    • SHA1

      223bef1f19e644a610a0877d01eadc9e28299509

    • SHA256

      f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

    • SHA512

      d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

    • SSDEEP

      192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz

    Score
    3/10
    discovery
    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Tasks