guloader | 0a55167fd6274ab545220243dcf2122a91c822e056859fbc9f617d7dbd2dfbb5

General

Target
Q-M20251302.exe
Size 737KB
Sample250214-hkstdawphv
SHA256 0a55167fd6274ab545220243dcf2122a91c822e056859fbc9f617d7dbd2dfbb5
MD5 4b790bfe7b7c165fb567d17b7fcd9348
SHA1 6313514ffe723ddbca6fb4caa3fda967a13f309b
SHA512 fa4faec78a5f327758aedec821f7b8120906696446aa2291d52beb15ad2dc89abd4e9e31def11e49b4c39e2b03ffe4626ed721d1eedfb87cbcb41a853dee2729
SSDEEP 12288:oF9ULOvBp5dYTAJpaE223R8Scy38SeD83S1nVCD1xnE8UML789zUO9vVOI0emBmv:A/vnXQop9uS13lRsnkpxnlGUOdb0emBy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7882249709:AAFvt51RgWj7pWTdMoxXSMdKbIgjZVh2YgY/sendMessage?chat_id=7972230855

Targets

- Target
  Q-M20251302.exe
- Size 737KB
- SHA256 0a55167fd6274ab545220243dcf2122a91c822e056859fbc9f617d7dbd2dfbb5
- MD5 4b790bfe7b7c165fb567d17b7fcd9348
- SHA1 6313514ffe723ddbca6fb4caa3fda967a13f309b
- SHA512 fa4faec78a5f327758aedec821f7b8120906696446aa2291d52beb15ad2dc89abd4e9e31def11e49b4c39e2b03ffe4626ed721d1eedfb87cbcb41a853dee2729
- SSDEEP 12288:oF9ULOvBp5dYTAJpaE223R8Scy38SeD83S1nVCD1xnE8UML789zUO9vVOI0emBmv:A/vnXQop9uS13lRsnkpxnlGUOdb0emBy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer collection spyware
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Downloads MZ/PE file
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
- MD5 cf85183b87314359488b850f9e97a698
- SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
- SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
- SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral3 behavioral4