guloader | c3be16e52a0fd48ac7a64b992dbdc6566c5e6d523466c91cce1109c20d64fc6e

General

Target

New Order.exe
Size

747KB
Sample

250204-re2nrsyjev
MD5

c0bed465b5df10e26d58f8dbba87a7e6
SHA1

49611ce1c8a200ac404c7cae77d81702d64192eb
SHA256

c3be16e52a0fd48ac7a64b992dbdc6566c5e6d523466c91cce1109c20d64fc6e
SHA512

751f3b2a4079dcbb00045effa35cac0c156a554d809800ef6b96b213a24cecb10b77b0ed562a6e62e4b27a4b992d67fc1792de9767e9262be95153a1731a22a5
SSDEEP

12288:dT58++c2/p0FdmxxSK1qwQWkOvdK9k7Yk13QpWm0KFymle/+bO3Y9M4X92C:dT58+86wxx51f0kNKFLUmbOltC

Score

10^/10

Malware Config

Targets

- Target
  
  New Order.exe
- Size
  
  747KB
- MD5
  
  c0bed465b5df10e26d58f8dbba87a7e6
- SHA1
  
  49611ce1c8a200ac404c7cae77d81702d64192eb
- SHA256
  
  c3be16e52a0fd48ac7a64b992dbdc6566c5e6d523466c91cce1109c20d64fc6e
- SHA512
  
  751f3b2a4079dcbb00045effa35cac0c156a554d809800ef6b96b213a24cecb10b77b0ed562a6e62e4b27a4b992d67fc1792de9767e9262be95153a1731a22a5
- SSDEEP
  
  12288:dT58++c2/p0FdmxxSK1qwQWkOvdK9k7Yk13QpWm0KFymle/+bO3Y9M4X92C:dT58+86wxx51f0kNKFLUmbOltC
Score

10^/10

discovery guloader collection downloader spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  d968cb2b98b83c03a9f02dd9b8df97dc
- SHA1
  
  d784c9b7a92dce58a5038beb62a48ff509e166a0
- SHA256
  
  a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
- SHA512
  
  2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
- SSDEEP
  
  192:CVA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:CrR7SrtTv53tdtTgwF4SQbGPX36wJMw
Score

3^/10

discovery
behavioral3 behavioral4