guloader | 18e8dc7f0541f1b4d3394d57ff222b78d9a6c22c2151512dd84d28cd9fbb7f01

General

Target

18e8dc7f0541f1b4d3394d57ff222b78d9a6c22c2151512dd84d28cd9fbb7f01.exe
Size

888KB
Sample

250207-eymbzaznfr
MD5

acd8c7211f329be0c798161973d6e437
SHA1

93b804432267947523bdbaf80d6d36ec7a028c5c
SHA256

18e8dc7f0541f1b4d3394d57ff222b78d9a6c22c2151512dd84d28cd9fbb7f01
SHA512

5bd28a73388a85942ad7a1fb568f20dc8b781e2be1aea61fba3def3fbdb8bb7178817889139b74277824fae29a15b87b8ddeba7c9326d6dd2e7c6b874256019b
SSDEEP

24576:F0fVDZQOtivSE8uN4BoR7qbiDLTmAYu+oA0Ar2P:St6O0vNNioKkMJ9C

Score

10^/10

Malware Config

Targets

- Target
  
  18e8dc7f0541f1b4d3394d57ff222b78d9a6c22c2151512dd84d28cd9fbb7f01.exe
- Size
  
  888KB
- MD5
  
  acd8c7211f329be0c798161973d6e437
- SHA1
  
  93b804432267947523bdbaf80d6d36ec7a028c5c
- SHA256
  
  18e8dc7f0541f1b4d3394d57ff222b78d9a6c22c2151512dd84d28cd9fbb7f01
- SHA512
  
  5bd28a73388a85942ad7a1fb568f20dc8b781e2be1aea61fba3def3fbdb8bb7178817889139b74277824fae29a15b87b8ddeba7c9326d6dd2e7c6b874256019b
- SSDEEP
  
  24576:F0fVDZQOtivSE8uN4BoR7qbiDLTmAYu+oA0Ar2P:St6O0vNNioKkMJ9C
Score

10^/10

guloader discovery downloader spyware stealer collection
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  960a5c48e25cf2bca332e74e11d825c9
- SHA1
  
  da35c6816ace5daf4c6c1d57b93b09a82ecdc876
- SHA256
  
  484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
- SHA512
  
  cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
- SSDEEP
  
  192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
Score

3^/10

discovery
behavioral3 behavioral4