Overview

overview

10

Static

static

3

Factura-689 Pdf.exe

windows7-x64

7

Factura-689 Pdf.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19022025_0207_18022025_Factura-689Pdf.7z

  • Size

    984KB

  • Sample

    250219-crfvhavkfj

  • MD5

    c8ffac2d81987ffb3837a14ad2ff97ad

  • SHA1

    0413e462f6245c94be4ceb79100985dfa77c9a5e

  • SHA256

    a5273afdc822aab59f0f62782e5fffe4adcfce9beab913053279fc3a02cce528

  • SHA512

    0e2f4795f5d62aec8b9444ee02d482c4595a9d1e96af634e4595818fba8a171f8351390426489fd7da921c051b5e06e3c133cb2b5fdbeb2e11279c8f681055f8

  • SSDEEP

    24576:CmZJx/0TmwYak0qnSuGCNLcEpnVOFzpoqbLQwoAnru:CS3Mh20qSdCNLcqIFVXbsZ4u

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      Factura-689 Pdf.exe

    • Size

      1.1MB

    • MD5

      5977943cffd5f2db561ef9535489b269

    • SHA1

      04cce835500bf7a5e219ef9e5d8dbb5f8db736b3

    • SHA256

      d1042ccf165aa69453ba0be79ccc4d36334fcac2487c070963675d24ab63f64d

    • SHA512

      69808c06221d9b3f1960280999f2d5e924efc69643e355788491911d060cdb6b97a017cf8965abee8138e86b7f96bbfeae7c0a0f78865b9e6aaafc39de9ac773

    • SSDEEP

      24576:bSafguPIipwDdMVGPV1MHkroUmLDbZ7Jjl7WqDs3Ry:blfguL4rMEbSFhWquR

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      2a0f58baa9f48961707195d3d9ab8d0a

    • SHA1

      abb640f58bd2a3fc50cd130bd960015df7a2a345

    • SHA256

      a9520ce3bcfa4cfb7d9be3d317bdb3068246b38292e6d291a55f1b04a158998e

    • SHA512

      273356a565978ff58d223e4d84de85d257838b1c37ae33054de76401ac935fd26f54213424ad8164bae2c4f9d9f2d61cbdd24bbaad453da938e0dca26b98130a

    • SSDEEP

      48:im1gEhmNd2MPUptxENJ5imMOBAZqMTBCpYwvNHZzUJvR0J56of5dwe:F1qdBGE75LBAZqIFeZUR0zPd

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      12b140583e3273ee1f65016becea58c4

    • SHA1

      92df24d11797fefd2e1f8d29be9dfd67c56c1ada

    • SHA256

      014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

    • SHA512

      49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

    • SSDEEP

      192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks