guloader | 756fbf36edbac9af59cc2787aae96f78cbdda4a2707dd222912095e763f2a57f | Triage

Sharing

General

Target

Payment_summaryRef_20251102e24.exe
Size

626KB
Sample

250218-thkwjavky5
MD5

de1f37e70efeae0839213b6432c6265f
SHA1

ec5459e719bad043c6d4f9f2a1b98c1ed1795b50
SHA256

756fbf36edbac9af59cc2787aae96f78cbdda4a2707dd222912095e763f2a57f
SHA512

aaa48d0abf37f0bf35a8c1a224f923f3dfac5656172906dcd2a6bd396afb50e7fdd67fd3c3a34f9eb4835c89dc037a04d875425af486a9e19b21070fee44b4d1
SSDEEP

12288:ZfZ6QaYTUyLtPZadefSO43NqKpEvUeIB5gp05sy2tHXbai1P4dX7:ZIdItgVtqw/jgry2tWiR4F

Score

10^/10

guloader collection discovery downloader macos spyware stealer

Malware Config

Targets

- Target
  
  Payment_summaryRef_20251102e24.exe
- Size
  
  626KB
- MD5
  
  de1f37e70efeae0839213b6432c6265f
- SHA1
  
  ec5459e719bad043c6d4f9f2a1b98c1ed1795b50
- SHA256
  
  756fbf36edbac9af59cc2787aae96f78cbdda4a2707dd222912095e763f2a57f
- SHA512
  
  aaa48d0abf37f0bf35a8c1a224f923f3dfac5656172906dcd2a6bd396afb50e7fdd67fd3c3a34f9eb4835c89dc037a04d875425af486a9e19b21070fee44b4d1
- SSDEEP
  
  12288:ZfZ6QaYTUyLtPZadefSO43NqKpEvUeIB5gp05sy2tHXbai1P4dX7:ZIdItgVtqw/jgry2tWiR4F
Score

10^/10

guloader collection discovery downloader spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  75ed96254fbf894e42058062b4b4f0d1
- SHA1
  
  996503f1383b49021eb3427bc28d13b5bbd11977
- SHA256
  
  a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- SHA512
  
  58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP
  
  192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  Bardily/undervisningsformens.app
- Size
  
  219KB
- MD5
  
  2a79ab217485962274353ed00ad54303
- SHA1
  
  5e8f0763b521c8b263fdaff95c303a472a1775cf
- SHA256
  
  2d9886502fb73e1cbc90a03fbefaf0bb6f772dbdd75f112ba41dc627adbce86a
- SHA512
  
  7961bbcd003bae4e57cc32decc174bd9f0244f857b3743161da94ede332d44f2383b442b93abf7974c7b3a905d9e9c641e228c215710d956574581bf8be9b22e
- SSDEEP
  
  768:kBlm9DznOh98cy26g9o1Xr4e8akHVxAzP6osegfDg8CN:kB09nF26IE72DAbzsegfD/CN
Score

1^/10
behavioral5

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

Browser Information Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

guloadercollectiondiscoverydownloaderspywarestealer

behavioral2

guloadercollectiondiscoverydownloaderspywarestealer

behavioral3

behavioral4

behavioral5