Overview

overview

10

Static

static

3

Payment Su... 2.exe

windows7-x64

10

Payment Su... 2.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Regnbuehin...ns.app

macos-10.15-amd64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1ee30fbfd3638d43f25285296af49d39b5dc7c67e7e2f4b4cd6440d59f54f29.z

  • Size

    584KB

  • Sample

    250220-ed2wxsxnz4

  • MD5

    ef24d568564cea644ae00627a1ebe545

  • SHA1

    03fbf4a58cd18759c6c6e51082d4df633ec89cc7

  • SHA256

    b1ee30fbfd3638d43f25285296af49d39b5dc7c67e7e2f4b4cd6440d59f54f29

  • SHA512

    df82b13b4d1d4b4dba66cd04b98fea20d1a233be10833cb454b6e853eb47fa41b91a7081634d3070feee8bc3c796820da65e89b1a51fafac88944692be08b80c

  • SSDEEP

    12288:4qHUS2/qwGuD5nA4Nq5SxvXFMLIWMSfd2jfJ0dr8ln7fiOV:Zar5nAX5SxvKLVMSV29u4fi2

Score
10/10
guloadercollectiondefense_evasiondiscoverydownloadermacosspywarestealer

Malware Config

Targets

    • Target

      Payment Summary 2025 11 2.exe

    • Size

      614KB

    • MD5

      6b654cb879dd6171a27f49ede0640dd0

    • SHA1

      f3b604c42287475b70a3372ac271b083bf47d617

    • SHA256

      4c4b1980eed21f43c792e2d1727b36c9a6cf04b7732250d4559ca4a2f341dda8

    • SHA512

      e4dcd46b03554ebbcbbad4fc007e09ef051e455a3f2b8a1cde3d7dd25a505d5bf04dae5d14d96e2f1f67d18efebdf4d434f1ba7aed876b605805a18c30e2001a

    • SSDEEP

      12288:ZfZ6QaYTUyLt20YOlIlBEpR72as3pKbax5fUxg9V0ttHXbai1P4dXV:ZIdItdYOCBM7l+psax5Mxg6tWiR4/

    Score
    10/10
    guloadercollectiondiscoverydownloaderspywarestealer

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      75ed96254fbf894e42058062b4b4f0d1

    • SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

    • SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    • SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • SSDEEP

      192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Regnbuehinden/undervisningsformens.app

    • Size

      219KB

    • MD5

      2a79ab217485962274353ed00ad54303

    • SHA1

      5e8f0763b521c8b263fdaff95c303a472a1775cf

    • SHA256

      2d9886502fb73e1cbc90a03fbefaf0bb6f772dbdd75f112ba41dc627adbce86a

    • SHA512

      7961bbcd003bae4e57cc32decc174bd9f0244f857b3743161da94ede332d44f2383b442b93abf7974c7b3a905d9e9c641e228c215710d956574581bf8be9b22e

    • SSDEEP

      768:kBlm9DznOh98cy26g9o1Xr4e8akHVxAzP6osegfDg8CN:kB09nF26IE72DAbzsegfD/CN

    Score
    4/10
    defense_evasion
    behavioral5

MITRE ATT&CK Enterprise v15

Tasks