guloader | 44a663bc646f29f072aacac558c728638406e0c6220f4d6e5fec71a39bde899a

General

Target
44a663bc646f29f072aacac558c728638406e0c6220f4d6e5fec71a39bde899a.exe
Size 415KB
Sample260109-sv8mpagw2d
SHA256 44a663bc646f29f072aacac558c728638406e0c6220f4d6e5fec71a39bde899a
MD5 1179aae55da946ea6330046da383068c
SHA1 1e11981f9c74460bbd221e6ee4d35670eb2c5357
SHA512 9de0b1af0675ab24c47ee513e5921932e8c589f5c9ae143b4bbacae027234f85f3c12bc64f9476e9c8256d2a3814f1a0cb4be1cb98d4049f998f045431261590
SSDEEP 12288:TXiR7PA9QWY+0dYHCbDqfZeFIWv5pWmoxUj+1Koj9FE+GSuMt1oS50gfctF4oIOV:TXiR7PA9QWY+0dYHCbDqfZeFIWv5pWmj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  44a663bc646f29f072aacac558c728638406e0c6220f4d6e5fec71a39bde899a.exe
- Size 415KB
- SHA256 44a663bc646f29f072aacac558c728638406e0c6220f4d6e5fec71a39bde899a
- MD5 1179aae55da946ea6330046da383068c
- SHA1 1e11981f9c74460bbd221e6ee4d35670eb2c5357
- SHA512 9de0b1af0675ab24c47ee513e5921932e8c589f5c9ae143b4bbacae027234f85f3c12bc64f9476e9c8256d2a3814f1a0cb4be1cb98d4049f998f045431261590
- SSDEEP 12288:TXiR7PA9QWY+0dYHCbDqfZeFIWv5pWmoxUj+1Koj9FE+GSuMt1oS50gfctF4oIOV:TXiR7PA9QWY+0dYHCbDqfZeFIWv5pWmj
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery downloader guloader
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader family

Guloader,Cloudeye

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6