guloader | 49847b4c6e5cccca50beccf23260cac3d3446feb0692cd113302b2fcaccbbefe

General

Target

49847b4c6e5cccca50beccf23260cac3d3446feb0692cd113302b2fcaccbbefe.exe
Size

743KB
Sample

250206-g725wsxqhk
MD5

92bca263fe2c4f6d7621457b5a758854
SHA1

81b5228c17dbcde2803f07e68fc2aeae907e2cf4
SHA256

49847b4c6e5cccca50beccf23260cac3d3446feb0692cd113302b2fcaccbbefe
SHA512

de9dea96a5d438f780a3e46fe3bdf0ab77f2f2131eeb2b01cbf98d69a573e3b0af994ed89e506725c0d14465001eb5f7660a4161a05995d1d6491929e32a538c
SSDEEP

12288:dT58++c2/p0FdmxxSKA+Rh8LYHjmLmyj/fzPzTyWaLj0wclOp24g/KHZJ:dT58+86wxx5A+Rh2YDmtHzTI30Mp7J

Score

10^/10

Malware Config

Targets

- Target
  
  49847b4c6e5cccca50beccf23260cac3d3446feb0692cd113302b2fcaccbbefe.exe
- Size
  
  743KB
- MD5
  
  92bca263fe2c4f6d7621457b5a758854
- SHA1
  
  81b5228c17dbcde2803f07e68fc2aeae907e2cf4
- SHA256
  
  49847b4c6e5cccca50beccf23260cac3d3446feb0692cd113302b2fcaccbbefe
- SHA512
  
  de9dea96a5d438f780a3e46fe3bdf0ab77f2f2131eeb2b01cbf98d69a573e3b0af994ed89e506725c0d14465001eb5f7660a4161a05995d1d6491929e32a538c
- SSDEEP
  
  12288:dT58++c2/p0FdmxxSKA+Rh8LYHjmLmyj/fzPzTyWaLj0wclOp24g/KHZJ:dT58+86wxx5A+Rh2YDmtHzTI30Mp7J
Score

10^/10

guloader discovery downloader collection spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  d968cb2b98b83c03a9f02dd9b8df97dc
- SHA1
  
  d784c9b7a92dce58a5038beb62a48ff509e166a0
- SHA256
  
  a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
- SHA512
  
  2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
- SSDEEP
  
  192:CVA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:CrR7SrtTv53tdtTgwF4SQbGPX36wJMw
Score

3^/10

discovery
behavioral3 behavioral4