guloader | 4c4b1980eed21f43c792e2d1727b36c9a6cf04b7732250d4559ca4a2f341dda8 | Triage

Sharing

General

Target

PaymentSummary2025112.exe
Size

614KB
Sample

250219-n34lgszrcl
MD5

6b654cb879dd6171a27f49ede0640dd0
SHA1

f3b604c42287475b70a3372ac271b083bf47d617
SHA256

4c4b1980eed21f43c792e2d1727b36c9a6cf04b7732250d4559ca4a2f341dda8
SHA512

e4dcd46b03554ebbcbbad4fc007e09ef051e455a3f2b8a1cde3d7dd25a505d5bf04dae5d14d96e2f1f67d18efebdf4d434f1ba7aed876b605805a18c30e2001a
SSDEEP

12288:ZfZ6QaYTUyLt20YOlIlBEpR72as3pKbax5fUxg9V0ttHXbai1P4dXV:ZIdItdYOCBM7l+psax5Mxg6tWiR4/

Score

10^/10

guloader collection defense_evasion discovery downloader macos spyware stealer

Malware Config

Targets

- Target
  
  PaymentSummary2025112.exe
- Size
  
  614KB
- MD5
  
  6b654cb879dd6171a27f49ede0640dd0
- SHA1
  
  f3b604c42287475b70a3372ac271b083bf47d617
- SHA256
  
  4c4b1980eed21f43c792e2d1727b36c9a6cf04b7732250d4559ca4a2f341dda8
- SHA512
  
  e4dcd46b03554ebbcbbad4fc007e09ef051e455a3f2b8a1cde3d7dd25a505d5bf04dae5d14d96e2f1f67d18efebdf4d434f1ba7aed876b605805a18c30e2001a
- SSDEEP
  
  12288:ZfZ6QaYTUyLt20YOlIlBEpR72as3pKbax5fUxg9V0ttHXbai1P4dXV:ZIdItdYOCBM7l+psax5Mxg6tWiR4/
Score

10^/10

guloader collection discovery downloader spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  75ed96254fbf894e42058062b4b4f0d1
- SHA1
  
  996503f1383b49021eb3427bc28d13b5bbd11977
- SHA256
  
  a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- SHA512
  
  58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP
  
  192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  Regnbuehinden/undervisningsformens.app
- Size
  
  219KB
- MD5
  
  2a79ab217485962274353ed00ad54303
- SHA1
  
  5e8f0763b521c8b263fdaff95c303a472a1775cf
- SHA256
  
  2d9886502fb73e1cbc90a03fbefaf0bb6f772dbdd75f112ba41dc627adbce86a
- SHA512
  
  7961bbcd003bae4e57cc32decc174bd9f0244f857b3743161da94ede332d44f2383b442b93abf7974c7b3a905d9e9c641e228c215710d956574581bf8be9b22e
- SSDEEP
  
  768:kBlm9DznOh98cy26g9o1Xr4e8akHVxAzP6osegfDg8CN:kB09nF26IE72DAbzsegfD/CN
Score

4^/10

defense_evasion
behavioral5

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

Browser Information Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

guloadercollectiondiscoverydownloaderspywarestealer

behavioral2

guloadercollectiondiscoverydownloaderspywarestealer

behavioral3

behavioral4

behavioral5

defense_evasion