guloader | ba0f881b0462cfdac753320699ef91fff494497e9fe3ac5c3b9af951f0e14b4f

General

Target

Payment13022025000001111928374.exe
Size

684KB
Sample

250213-nqj2baxkhj
MD5

a427b0f23670795d88e895ac89f409ef
SHA1

1dbbf6026db9fd2a608b9bf20e4ff0d5412586f1
SHA256

ba0f881b0462cfdac753320699ef91fff494497e9fe3ac5c3b9af951f0e14b4f
SHA512

a03e1436cbea3061d8e1094294c21103ceb8d5ded2a03194fbe90b41a0c4e0e2753ca449b0d432f38f916897aeba956e6632dc34c91ae910c429a7bb6841369c
SSDEEP

12288:hDG4hAuAs8nf8gvArebnK9JUnnMam9x3neWTTiiuolhLFz:t2ns8nf8gvue7K9+nM59x3eWf4oLLFz

Score

10^/10

Malware Config

Targets

- Target
  
  Payment13022025000001111928374.exe
- Size
  
  684KB
- MD5
  
  a427b0f23670795d88e895ac89f409ef
- SHA1
  
  1dbbf6026db9fd2a608b9bf20e4ff0d5412586f1
- SHA256
  
  ba0f881b0462cfdac753320699ef91fff494497e9fe3ac5c3b9af951f0e14b4f
- SHA512
  
  a03e1436cbea3061d8e1094294c21103ceb8d5ded2a03194fbe90b41a0c4e0e2753ca449b0d432f38f916897aeba956e6632dc34c91ae910c429a7bb6841369c
- SSDEEP
  
  12288:hDG4hAuAs8nf8gvArebnK9JUnnMam9x3neWTTiiuolhLFz:t2ns8nf8gvue7K9+nM59x3eWf4oLLFz
Score

10^/10

guloader discovery downloader spyware stealer collection
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Downloads MZ/PE file
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  ee260c45e97b62a5e42f17460d406068
- SHA1
  
  df35f6300a03c4d3d3bd69752574426296b78695
- SHA256
  
  e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
- SHA512
  
  a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
- SSDEEP
  
  192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral3 behavioral4