guloader | 6f9ad6320e5d82c433669aeb69751149c97574bb019f837913c7166d1710008e

General

Target

6f9ad6320e5d82c433669aeb69751149c97574bb019f837913c7166d1710008e.exe
Size

931KB
Sample

250215-dszvfatmal
MD5

e40ac1a7e19f07f44f092a4adaa3e683
SHA1

44b9f572b6d962625ca97f3196daeee1a3884b36
SHA256

6f9ad6320e5d82c433669aeb69751149c97574bb019f837913c7166d1710008e
SHA512

03837b5e2f900a362e6f6804dc89e58e8fab9baf2330ea3c73ebc6181cdfa457f96d6dd8fb5208586093a520f9508cb4548dfe8e99d5968fb8730a784ba3fbcd
SSDEEP

24576:OPx/Z54yLh4PUe3g2lRnQnb7O0lo9arWoI:ux/Z5th4//k7JlEarQ

Score

10^/10

Malware Config

Targets

- Target
  
  6f9ad6320e5d82c433669aeb69751149c97574bb019f837913c7166d1710008e.exe
- Size
  
  931KB
- MD5
  
  e40ac1a7e19f07f44f092a4adaa3e683
- SHA1
  
  44b9f572b6d962625ca97f3196daeee1a3884b36
- SHA256
  
  6f9ad6320e5d82c433669aeb69751149c97574bb019f837913c7166d1710008e
- SHA512
  
  03837b5e2f900a362e6f6804dc89e58e8fab9baf2330ea3c73ebc6181cdfa457f96d6dd8fb5208586093a520f9508cb4548dfe8e99d5968fb8730a784ba3fbcd
- SSDEEP
  
  24576:OPx/Z54yLh4PUe3g2lRnQnb7O0lo9arWoI:ux/Z5th4//k7JlEarQ
Score

10^/10

guloader collection discovery downloader spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Downloads MZ/PE file
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral3 behavioral4