guloader | d6db00fc34f63f9f42baf31ce1a3b0450cd9182978872e61b45c2e2a2a246f85 | Triage

Sharing

General

Target

RFQMarchorderRef28101.exe
Size

605KB
Sample

250219-jssc9asrx9
MD5

1e3f98f846f1f269d07ed600aee399f0
SHA1

40debddcfcd43f79475f1c1aa804c2724141638c
SHA256

d6db00fc34f63f9f42baf31ce1a3b0450cd9182978872e61b45c2e2a2a246f85
SHA512

93f08b7d92871c3b842ad9b4edec4543448d07172819d717a46d1daddde13f3d8de798fe025197d13d1a4ce8e183eab7b3f82778ded6e55b2189bb11e908de30
SSDEEP

12288:ZfZ6QaYTUyLtXFyUU4etfo/lS5vaobgZFjjtHXbai1P4dXD:ZIdItXFPUVelS5imgZdjtWiR4h

Score

10^/10

guloader collection discovery downloader macos spyware stealer

Malware Config

Targets

- Target
  
  RFQMarchorderRef28101.exe
- Size
  
  605KB
- MD5
  
  1e3f98f846f1f269d07ed600aee399f0
- SHA1
  
  40debddcfcd43f79475f1c1aa804c2724141638c
- SHA256
  
  d6db00fc34f63f9f42baf31ce1a3b0450cd9182978872e61b45c2e2a2a246f85
- SHA512
  
  93f08b7d92871c3b842ad9b4edec4543448d07172819d717a46d1daddde13f3d8de798fe025197d13d1a4ce8e183eab7b3f82778ded6e55b2189bb11e908de30
- SSDEEP
  
  12288:ZfZ6QaYTUyLtXFyUU4etfo/lS5vaobgZFjjtHXbai1P4dXD:ZIdItXFPUVelS5imgZdjtWiR4h
Score

10^/10

guloader collection discovery downloader spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  75ed96254fbf894e42058062b4b4f0d1
- SHA1
  
  996503f1383b49021eb3427bc28d13b5bbd11977
- SHA256
  
  a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- SHA512
  
  58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP
  
  192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  Forldreknudernes/undervisningsformens.app
- Size
  
  219KB
- MD5
  
  2a79ab217485962274353ed00ad54303
- SHA1
  
  5e8f0763b521c8b263fdaff95c303a472a1775cf
- SHA256
  
  2d9886502fb73e1cbc90a03fbefaf0bb6f772dbdd75f112ba41dc627adbce86a
- SHA512
  
  7961bbcd003bae4e57cc32decc174bd9f0244f857b3743161da94ede332d44f2383b442b93abf7974c7b3a905d9e9c641e228c215710d956574581bf8be9b22e
- SSDEEP
  
  768:kBlm9DznOh98cy26g9o1Xr4e8akHVxAzP6osegfDg8CN:kB09nF26IE72DAbzsegfD/CN
Score

1^/10
behavioral5

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

Browser Information Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

guloadercollectiondiscoverydownloaderspywarestealer

behavioral2

guloadercollectiondiscoverydownloaderspywarestealer

behavioral3

behavioral4

behavioral5