guloader | 02388aba1adb686063dba875c903764ce6fa725393ececc2d71c8cb111830b07

General

Target
02388aba1adb686063dba875c903764ce6fa725393ececc2d71c8cb111830b07.exe
Size 596KB
Sample260528-ssvcaaes4v
SHA256 02388aba1adb686063dba875c903764ce6fa725393ececc2d71c8cb111830b07
MD5 0f8b7cacf491c03ef391a321be149d96
SHA1 0978bf0c6e4a21480eb48b9bee398092ac419ee8
SHA512 c96b6c21ccc6076e631c780b499c142226851bc778cf5068b2702ded21988c0c1a5b2cef161e66994c16afa601fe66b76e1f2bddca90c1bb206a306213580b40
SSDEEP 6144:R5lz/2vCy++HyvHwk/Bg2hkH2vvXk3F/nTYhauiQ4LRSB0482xEnRy8FNYesPYSP:LsGS2xvv4f8hmKuFnY8v8PYW0TPdg5Z
TLSH
T1CDD4F163A694BE13C267517E60AA82D2AA7BBD10F76391372790773F98FD040C60B357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  02388aba1adb686063dba875c903764ce6fa725393ececc2d71c8cb111830b07.exe
- Size 596KB
- SHA256 02388aba1adb686063dba875c903764ce6fa725393ececc2d71c8cb111830b07
- MD5 0f8b7cacf491c03ef391a321be149d96
- SHA1 0978bf0c6e4a21480eb48b9bee398092ac419ee8
- SHA512 c96b6c21ccc6076e631c780b499c142226851bc778cf5068b2702ded21988c0c1a5b2cef161e66994c16afa601fe66b76e1f2bddca90c1bb206a306213580b40
- SSDEEP 6144:R5lz/2vCy++HyvHwk/Bg2hkH2vvXk3F/nTYhauiQ4LRSB0482xEnRy8FNYesPYSP:LsGS2xvv4f8hmKuFnY8v8PYW0TPdg5Z
- TLSH
  T1CDD4F163A694BE13C267517E60AA82D2AA7BBD10F76391372790773F98FD040C60B357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6