guloader | cef132205540182897e4427f02b880c3ad994ffdf68f88949ba026daa0b79493

General

Target

14022025_0947_13022025_RFQ-031117_PDF.7z
Size

798KB
Sample

250214-lsd7qs1rep
MD5

07588933e7fdad93284229525053d75d
SHA1

f2b4e43fa32950d6062b26bf1f919c77eef01b82
SHA256

cef132205540182897e4427f02b880c3ad994ffdf68f88949ba026daa0b79493
SHA512

489ee4855f933591237d583766d1b8249720994147a2312aaccc31742e341f2527cbb45ec991cda2a647be06e2981e52c8be5c499c7fb3d31a0b6011d35a083d
SSDEEP

24576:HtiFN4rn6yZQw/2coxxGjlrSPBtWHNMaI8j:Ht04GeQOXoxxGjlWPXWHRH

Score

10^/10

Malware Config

Targets

- Target
  
  RFQ-031117_PDF.exe
- Size
  
  902KB
- MD5
  
  cf9a10348e967ec63679969fd43fe3af
- SHA1
  
  807abc926e32662848257320053a8d6004971796
- SHA256
  
  cba3b06165b69aa5a54ae6f04eaae0564dfba9ee41e66f45d92174200a408177
- SHA512
  
  70bfeaff022b623da3f06394f918638b025b1fe5e92226a9efbe4c39a79063433a93051e020b8d34fe2a29d58d1255b3688f4d065868ba9bec255832de2137ea
- SSDEEP
  
  24576:OPx/Z540GDfK/FzexD/uJ+xmznQnb7O0lo9arWo8:ux/Z50K0juJ+17JlEarE
Score

10^/10

guloader collection discovery downloader spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Downloads MZ/PE file
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral3 behavioral4