guloader | 6b8f70cd803ff2549ac826d910270e67d20561fdaef938a8af217a697f953447

General

Target
11062026_0351_10062026_454889-w4s.tar
Size 215KB
Sample260611-eelw4ahv7z
SHA256 6b8f70cd803ff2549ac826d910270e67d20561fdaef938a8af217a697f953447
MD5 796ef2e8ee45eef3a938ff71a84ca14d
SHA1 e7b84e7f152aeedf8a02fcdb9001cb36986612f8
SHA512 4a33407a121bfc1b37211d661253c159eb28dfb7d16701560cb21520b94a4ff418af398d3debb508cfb1a8da2b49c152005d4119dfeaa7a1537afa2436f14a66
SSDEEP 6144:6bE/HU5qqPy0UYuXqcvuOK0AEgJIGt71ucllcf:6bFqq8HvPfA9OGvucl+
TLSH
T1CF240220A6104C67E4E102B699659BF7DBBBDC5162808F0B1B547EAF3D732B1980F367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  454889-w4s.exe
- Size 213KB
- SHA256 4c4d1c58dd3e66b0710d9653b8ea2475d1488c44107fb2cb54756559dcad9610
- MD5 ba55fa65bb5defbe37f21fd21e08dc7e
- SHA1 1c6c168a9e719002e676ccee2874eb6cf96c46b6
- SHA512 d65dea46d02cb4cff236979ddfefc13c26a71744583d44606b38e9a3ee01d9855b31942b9ffeab6884f22887a778fe1f809efa599f44398996a38676d220c788
- SSDEEP 6144:JbE/HU5qqPy0UYuXqcvuOK0AEgJIGt71ucllcf8:JbFqq8HvPfA9OGvucl+U
- TLSH
  T1C7240220A6104C67E4E102B699659BF7DBBBDC5162808F0B1B547EAF3D732B1980F367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6