guloader | 4189edfc0aa08a91ae37b7d0cfd3c61eae29e8b72f800eb4740edebc4ba3f246

General

Target

PO00408_PDF.exe
Size

540KB
Sample

250205-t5ggmavlax
MD5

5e296704dc35eb43c3365d6492671262
SHA1

1865af05a87698879496c739ca3a23abdbbbe2b4
SHA256

4189edfc0aa08a91ae37b7d0cfd3c61eae29e8b72f800eb4740edebc4ba3f246
SHA512

7617f1287c957845db63bc1fad2288e6d618ca6bd293bd0e92ef4e47aa35185936fe5a7e1a4e934c0ba4d9f4ed6da26b9bc8d0511e480015a514068b1c2ed59f
SSDEEP

12288:9bLlN73eJi4xLlj5lJNTYRVV1zqaMLceQTi4GCk9/PxCGGd/9hKVZFDN:9bzSJikj5KN1zfMLceQ6Ck9/PxOd3KP

Score

10^/10

Malware Config

Targets

- Target
  
  PO00408_PDF.exe
- Size
  
  540KB
- MD5
  
  5e296704dc35eb43c3365d6492671262
- SHA1
  
  1865af05a87698879496c739ca3a23abdbbbe2b4
- SHA256
  
  4189edfc0aa08a91ae37b7d0cfd3c61eae29e8b72f800eb4740edebc4ba3f246
- SHA512
  
  7617f1287c957845db63bc1fad2288e6d618ca6bd293bd0e92ef4e47aa35185936fe5a7e1a4e934c0ba4d9f4ed6da26b9bc8d0511e480015a514068b1c2ed59f
- SSDEEP
  
  12288:9bLlN73eJi4xLlj5lJNTYRVV1zqaMLceQTi4GCk9/PxCGGd/9hKVZFDN:9bzSJikj5KN1zfMLceQ6Ck9/PxOd3KP
Score

10^/10

guloader discovery downloader spyware stealer collection
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral3 behavioral4