guloader | 6309b0b350542faf15428804903568533e671e768ca928a15479fe5f021a03b9

General

Target
6309b0b350542faf15428804903568533e671e768ca928a15479fe5f021a03b9.exe
Size 497KB
Sample260703-yej72sft51
SHA256 6309b0b350542faf15428804903568533e671e768ca928a15479fe5f021a03b9
MD5 78244c4ca11f3c471ee34bf71cc9d933
SHA1 3df2469ee5bb829dace9bd636d5a910611b9fcd8
SHA512 281d0b53068929a03db7217639c2454dc37ad2e52756408afbed4af16ba51b2d9828921ca11faaf0df77f2d432107590753fc7d698d5f24d8ebd54face981170
SSDEEP 12288:GyWZK0nGbgcXhM9aeqf8tAWuh+x7NKokTHVy18AwQjA:GyWZK0nxwM9a7zuN4kmAwQU
TLSH
T1EFB4220127A48807D9F2AB314A7A68B6D52FCC69197DA34B0B043F9B7D72271D59F323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  6309b0b350542faf15428804903568533e671e768ca928a15479fe5f021a03b9.exe
- Size 497KB
- SHA256 6309b0b350542faf15428804903568533e671e768ca928a15479fe5f021a03b9
- MD5 78244c4ca11f3c471ee34bf71cc9d933
- SHA1 3df2469ee5bb829dace9bd636d5a910611b9fcd8
- SHA512 281d0b53068929a03db7217639c2454dc37ad2e52756408afbed4af16ba51b2d9828921ca11faaf0df77f2d432107590753fc7d698d5f24d8ebd54face981170
- SSDEEP 12288:GyWZK0nGbgcXhM9aeqf8tAWuh+x7NKokTHVy18AwQjA:GyWZK0nxwM9a7zuN4kmAwQU
- TLSH
  T1EFB4220127A48807D9F2AB314A7A68B6D52FCC69197DA34B0B043F9B7D72271D59F323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4