guloader | 7ad9417654278969ee57fa1829efbeed2e838c23af4dffb9a947a9cf9a028d0d | Triage

Sharing

General

Target

7ad9417654278969ee57fa1829efbeed2e838c23af4dffb9a947a9cf9a028d0d.exe
Size

957KB
Sample

250207-fqqj4azlct
MD5

ee6365fdf115ff94b4e9198af755b9d0
SHA1

22cc84f737d62b95ce0fc4e41a8847fb0ee1937f
SHA256

7ad9417654278969ee57fa1829efbeed2e838c23af4dffb9a947a9cf9a028d0d
SHA512

680afd4223d04295cdb9bbe6b6775e35f0b70b509c4102fa4d8e9cccf911732ab6ea8fee7864ef65beb6795a3c4e303773485d92b3334101c0e5dc53eb443118
SSDEEP

24576:FerYnK4TwIld1V20+FDbzUNSrmbS1m65cAo9wGniPvPEx8UiFV:FerYnKRIlHV20+FDbz7rmbS1mjBavch6

Score

10^/10

guloader discovery downloader persistence

Malware Config

Targets

- Target
  
  7ad9417654278969ee57fa1829efbeed2e838c23af4dffb9a947a9cf9a028d0d.exe
- Size
  
  957KB
- MD5
  
  ee6365fdf115ff94b4e9198af755b9d0
- SHA1
  
  22cc84f737d62b95ce0fc4e41a8847fb0ee1937f
- SHA256
  
  7ad9417654278969ee57fa1829efbeed2e838c23af4dffb9a947a9cf9a028d0d
- SHA512
  
  680afd4223d04295cdb9bbe6b6775e35f0b70b509c4102fa4d8e9cccf911732ab6ea8fee7864ef65beb6795a3c4e303773485d92b3334101c0e5dc53eb443118
- SSDEEP
  
  24576:FerYnK4TwIld1V20+FDbzUNSrmbS1m65cAo9wGniPvPEx8UiFV:FerYnKRIlHV20+FDbz7rmbS1mjBavch6
Score

10^/10

guloader discovery downloader persistence
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1
  
  c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA256
  
  7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- SHA512
  
  4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP
  
  192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

guloaderdiscoverydownloaderpersistence

behavioral2

guloaderdiscoverydownloaderpersistence

behavioral3

behavioral4