Overview

overview

10

Static

static

3

Quote_2025...df.exe

windows7-x64

10

Quote_2025...df.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Foredoomin...ns.app

macos-10.15-amd64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Quote_2025-0770915101-UAE-25_pdf.exe

  • Size

    669KB

  • Sample

    250219-g82whszka1

  • MD5

    88c611266f18f7db91d7755063429d75

  • SHA1

    1b1086c2217f9a6bf743007a958eff87a0293bd8

  • SHA256

    7ef76197f97772ab780fe7921992a6e95af21cba5d200302d47a5dbb7fde636e

  • SHA512

    7e9cd2d6776fbca98c7e75c60cb37ea29d468c7b447d5e0f0c71636196ae603718827f0a4b0f64c10e2fce0afce877ec8983d8df8d8b86707552998584a7e2de

  • SSDEEP

    12288:ZfZ6QaYTUyLt4y7Er2/YHVy6gzt2s+CBxpObgVMNkhtHXbai1P4dXO:ZIdIte2/Y1vgtB+YQbg+NotWiR4w

Score
10/10
guloadercollectiondefense_evasiondiscoverydownloadermacosspywarestealer

Malware Config

Targets

    • Target

      Quote_2025-0770915101-UAE-25_pdf.exe

    • Size

      669KB

    • MD5

      88c611266f18f7db91d7755063429d75

    • SHA1

      1b1086c2217f9a6bf743007a958eff87a0293bd8

    • SHA256

      7ef76197f97772ab780fe7921992a6e95af21cba5d200302d47a5dbb7fde636e

    • SHA512

      7e9cd2d6776fbca98c7e75c60cb37ea29d468c7b447d5e0f0c71636196ae603718827f0a4b0f64c10e2fce0afce877ec8983d8df8d8b86707552998584a7e2de

    • SSDEEP

      12288:ZfZ6QaYTUyLt4y7Er2/YHVy6gzt2s+CBxpObgVMNkhtHXbai1P4dXO:ZIdIte2/Y1vgtB+YQbg+NotWiR4w

    Score
    10/10
    guloaderdiscoverydownloadercollectionspywarestealer

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      75ed96254fbf894e42058062b4b4f0d1

    • SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

    • SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    • SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • SSDEEP

      192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Foredooming/undervisningsformens.app

    • Size

      219KB

    • MD5

      2a79ab217485962274353ed00ad54303

    • SHA1

      5e8f0763b521c8b263fdaff95c303a472a1775cf

    • SHA256

      2d9886502fb73e1cbc90a03fbefaf0bb6f772dbdd75f112ba41dc627adbce86a

    • SHA512

      7961bbcd003bae4e57cc32decc174bd9f0244f857b3743161da94ede332d44f2383b442b93abf7974c7b3a905d9e9c641e228c215710d956574581bf8be9b22e

    • SSDEEP

      768:kBlm9DznOh98cy26g9o1Xr4e8akHVxAzP6osegfDg8CN:kB09nF26IE72DAbzsegfD/CN

    Score
    4/10
    defense_evasion
    behavioral5

MITRE ATT&CK Enterprise v15

Tasks