Overview

overview

10

Static

static

3

Purchase O...22.exe

windows7-x64

10

Purchase O...22.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19022025_1711_19022025_PurchaseOrder024522.z

  • Size

    797KB

  • Sample

    250219-vtnx1avnd1

  • MD5

    ce39b1bbb548f888638b498d722c9c88

  • SHA1

    00c761e48e2adfcb0d41ecbd04e59241c3922d18

  • SHA256

    8dcc335a44f7d2078d13d14e5c8b43ebdf7af632c9275df6ee7f0d3cae0f3f5e

  • SHA512

    49052821b569045e30bcbf2843574b1f88c26c28942c2e5074408e02be5f65de64928e2251b6544f2562f9fa102defd07d61f67b81018c399dea8e4133b2e16f

  • SSDEEP

    12288:OPZD91KEjFiaUJAw9YCXF8mjhMP6FjUUh3roNO2lfDlUHZOQL7X4hL3NbhyIZxgo:OPZffFSJ1lbFv38ffD6HZOQLDw91Psno

Score
10/10
guloaderdiscoverydownloaderpersistence

Malware Config

Targets

    • Target

      Purchase Order 024522.exe

    • Size

      825KB

    • MD5

      540a9d014492a0eef7dd39984814c278

    • SHA1

      15e2c7623fe9c50c9753c89b4a210f806f303dd5

    • SHA256

      9b67f5d336062f8b471d193ff5b6d30cb182fa4beaa50bbfcf4014ac8c674c0c

    • SHA512

      09c3cdbdda62d8fbb2bcdfbe46529da3c4bbdf863aab7d6020647c27510c7fcff97e9448fb2335536ab9eb4e0c80ec967e8af2182daf2c8a4448b2dc41c55a2a

    • SSDEEP

      24576:zrXkv02YuF7mDsS7XeTzJ9I501QG1n18Vy:PXkv0KF7o9iCRynSVy

    Score
    10/10
    guloaderdiscoverydownloaderpersistence

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      9625d5b1754bc4ff29281d415d27a0fd

    • SHA1

      80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

    • SHA256

      c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

    • SHA512

      dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

    • SSDEEP

      192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks