Overview

overview

10

Static

static

1

da45546784...2c.exe

windows7-x64

10

da45546784...2c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da45546784229c2b0ee9a108a488b4470fd33eb668cfc813a1b60c43e28d542c.exe

  • Size

    854KB

  • Sample

    250208-lqh3xaxngz

  • MD5

    6c4f4ca9f44babf65f707c6039c7fcc9

  • SHA1

    e433eed78c2da478605fe462f1329974becda052

  • SHA256

    da45546784229c2b0ee9a108a488b4470fd33eb668cfc813a1b60c43e28d542c

  • SHA512

    efe808042fc3c05f445761c6e0156b5ad04dcdfdfd35b5883b7d43e2f1821f0744c5f766ebccf2a56305f81cb458b64c0b30f975affb86ab95e38426376bbf5c

  • SSDEEP

    12288:wrRquUH6UROvPORRu4B5jPlxxsUzZbhuOWzM6QnVKEYyO/7ziee/:j/H6URd/B5Zxx3zZ9uFzTEKE7OaeK

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      da45546784229c2b0ee9a108a488b4470fd33eb668cfc813a1b60c43e28d542c.exe

    • Size

      854KB

    • MD5

      6c4f4ca9f44babf65f707c6039c7fcc9

    • SHA1

      e433eed78c2da478605fe462f1329974becda052

    • SHA256

      da45546784229c2b0ee9a108a488b4470fd33eb668cfc813a1b60c43e28d542c

    • SHA512

      efe808042fc3c05f445761c6e0156b5ad04dcdfdfd35b5883b7d43e2f1821f0744c5f766ebccf2a56305f81cb458b64c0b30f975affb86ab95e38426376bbf5c

    • SSDEEP

      12288:wrRquUH6UROvPORRu4B5jPlxxsUzZbhuOWzM6QnVKEYyO/7ziee/:j/H6URd/B5Zxx3zZ9uFzTEKE7OaeK

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Downloads MZ/PE file

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks