guloader | 59dcfbf61ced41a5f09385cd4a795312a35b5d454064bcf97bb887bbffef8b04

General

Target
59dcfbf61ced41a5f09385cd4a795312a35b5d454064bcf97bb887bbffef8b04.exe
Size 1.2MB
Sample260109-st4mcagv4e
SHA256 59dcfbf61ced41a5f09385cd4a795312a35b5d454064bcf97bb887bbffef8b04
MD5 4bb17c379038b3eb5c12861132e8819a
SHA1 a6240319d5aed0193e51c69d953fb2107c81e69e
SHA512 3693f0a48fa90666e2fe32431a70d5dd0ee82302f74eb34d20a6b243f9c06cd963d7c60dd11ab4755cc267328670527c26ee5c0761caea0cc9433995840fa8aa
SSDEEP 24576:yTMn6rH75Z2EGuyURQhzRACxeEzpVessMBFa8QRQt5bgw/msswwYz1pWq:yTMn6rHNZ2nuGXsmpV7sMXPQRQt5h3sm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  59dcfbf61ced41a5f09385cd4a795312a35b5d454064bcf97bb887bbffef8b04.exe
- Size 1.2MB
- SHA256 59dcfbf61ced41a5f09385cd4a795312a35b5d454064bcf97bb887bbffef8b04
- MD5 4bb17c379038b3eb5c12861132e8819a
- SHA1 a6240319d5aed0193e51c69d953fb2107c81e69e
- SHA512 3693f0a48fa90666e2fe32431a70d5dd0ee82302f74eb34d20a6b243f9c06cd963d7c60dd11ab4755cc267328670527c26ee5c0761caea0cc9433995840fa8aa
- SSDEEP 24576:yTMn6rH75Z2EGuyURQhzRACxeEzpVessMBFa8QRQt5bgw/msswwYz1pWq:yTMn6rHNZ2nuGXsmpV7sMXPQRQt5h3sm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery downloader guloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
- MD5 48f3e7860e1de2b4e63ec744a5e9582a
- SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
- SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
- SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader family

Guloader,Cloudeye

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6