guloader | 22180dbe00565baf7f087e77f304354fd262eadfb69ce62471949eacc2eebcd3

General

Target

C8Y6H_RFQAlGeemi_MiddleEast_Project2025BOQ.exe
Size

1.0MB
Sample

250211-v6y9havldz
MD5

66b205fe2b23ccffbf7d6ec657f04cee
SHA1

df36fc8d3668da753a03d3c1f8eb3d0c4f9861f3
SHA256

22180dbe00565baf7f087e77f304354fd262eadfb69ce62471949eacc2eebcd3
SHA512

78f743754646ae308c932b68701e05c750f63d8ddbf06bff5a3129360c42300dd37fbf5303fa2903d6e6622f6a1adc12872dda207a113e479f5762a72e6afbb7
SSDEEP

12288:LzORStC06lt5luakiWkh/k+hyxYnJHCGsrGKy/D+8aG8mFT/+Agidpit:LzOEC045lrkvu/uxqCGsCcNG5Hgapa

Score

10^/10

Malware Config

Targets

- Target
  
  C8Y6H_RFQAlGeemi_MiddleEast_Project2025BOQ.exe
- Size
  
  1.0MB
- MD5
  
  66b205fe2b23ccffbf7d6ec657f04cee
- SHA1
  
  df36fc8d3668da753a03d3c1f8eb3d0c4f9861f3
- SHA256
  
  22180dbe00565baf7f087e77f304354fd262eadfb69ce62471949eacc2eebcd3
- SHA512
  
  78f743754646ae308c932b68701e05c750f63d8ddbf06bff5a3129360c42300dd37fbf5303fa2903d6e6622f6a1adc12872dda207a113e479f5762a72e6afbb7
- SSDEEP
  
  12288:LzORStC06lt5luakiWkh/k+hyxYnJHCGsrGKy/D+8aG8mFT/+Agidpit:LzOEC045lrkvu/uxqCGsCcNG5Hgapa
Score

10^/10

guloader collection discovery downloader spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Downloads MZ/PE file
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral3 behavioral4