Overview

overview

10

Static

static

3

PO00408.exe

windows7-x64

7

PO00408.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05022025_1612_05022025_PO00408.7z

  • Size

    698KB

  • Sample

    250205-tnwvzstnez

  • MD5

    eea90633ad821bb7712fd7a5a2ca5fa3

  • SHA1

    8832f3e7feeca53a2efc835f317f5a1a009e1110

  • SHA256

    3fadf1eda955fa1b1399c1b613ab4be6a742c07b45b8b97654c8440fee7b4b85

  • SHA512

    627f3050fc0481e7f11e8e73f0837cce13cefc99ace6ea92753b37b0a3f42f57e7148bfab5b68e3b2c1d2757449413944705711ac474b8e2b6ba1fa375d4f828

  • SSDEEP

    12288:dhCYBExizDMSSuQSbeo4/DFKVpn/llt9mh1uTtM1Vos7LB/FQto:dkYBE0zDMSWfLcJ3t9m1pVos7L/Qto

Score
10/10
guloadercollectiondiscoverydownloaderspywarestealer

Malware Config

Targets

    • Target

      PO00408.exe

    • Size

      820KB

    • MD5

      d536792833e07c224ad3abc433f71c38

    • SHA1

      78f20231f4f66ff515a04d61f92fc17b4076220e

    • SHA256

      660b9e0687beaa726ba6cfb151c65cd5d6709bfc6e9c642215d74465d3bea775

    • SHA512

      897d98945aefededa5dacdaf996a1661d5646df2e44ea05ad357f6b2d7469d28a9acb69755fe00a68316f2a21f5f2c059ab547cddf294eaff258c64c96d27b81

    • SSDEEP

      24576:Q4nbY9dZZZZZZZZZZyoXXj3J35sHPzvvV3HQmhQ436/zJ:Q+qZZZZZZZZZZZXz3JKHrvv1wzq6N

    Score
    10/10
    discoveryguloadercollectiondownloaderspywarestealer

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      d6f54d2cefdf58836805796f55bfc846

    • SHA1

      b980addc1a755b968dd5799179d3b4f1c2de9d2d

    • SHA256

      f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9

    • SHA512

      ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db

    • SSDEEP

      192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks