guloader | 2e8d23b7f77e7578af862bfb3a5ad652fe19cd2be13da309a65e0402ebdbd7fd

General

Target
MS-KW92Swift-20-CMD9200-XE3911-XW2900-MI2982-.exe
Size 555KB
Sample251209-clys5abp2s
SHA256 2e8d23b7f77e7578af862bfb3a5ad652fe19cd2be13da309a65e0402ebdbd7fd
MD5 a1ba70ff00ae2282efe8d2e175611e72
SHA1 2168228311e69214883173b5d8ec63a47b2ea36d
SHA512 775c5b7137156d1c33014c7599ae02c3dc6ab03e549aaa6558c17b65464ffc5905cb24f71a3b15cc97adaefbea39d6f9b3cd8375ef017446ea61084334d8b7b9
SSDEEP 6144:EicFyEa8zeyw8eTpxN/fhrs3xcyYFh1+1zYeRIKg18tHmjVd2TC1DuQM6nMCYkwO:HQa8zeNx9zHOBB+2JrRn5Hwd2+13MRkz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  MS-KW92Swift-20-CMD9200-XE3911-XW2900-MI2982-.exe
- Size 555KB
- SHA256 2e8d23b7f77e7578af862bfb3a5ad652fe19cd2be13da309a65e0402ebdbd7fd
- MD5 a1ba70ff00ae2282efe8d2e175611e72
- SHA1 2168228311e69214883173b5d8ec63a47b2ea36d
- SHA512 775c5b7137156d1c33014c7599ae02c3dc6ab03e549aaa6558c17b65464ffc5905cb24f71a3b15cc97adaefbea39d6f9b3cd8375ef017446ea61084334d8b7b9
- SSDEEP 6144:EicFyEa8zeyw8eTpxN/fhrs3xcyYFh1+1zYeRIKg18tHmjVd2TC1DuQM6nMCYkwO:HQa8zeNx9zHOBB+2JrRn5Hwd2+13MRkz
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery downloader guloader persistence collection spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6