guloader | 11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb

General

Target
11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb.exe
Size 571KB
Sample260703-yxbcvsfw41
SHA256 11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb
MD5 693d96e5e78e84dffa825682015ed434
SHA1 e4c82332c18ec8204e754fdf39119f02735adea5
SHA512 8758bf347a123607f5ca7c1beeff4368f99f8dd4dd9fc094937665ee5c9bb0fe31915b7dc15c0101c57a347fc4e21db8310a8c5f5dd340b56b5441426dd01584
SSDEEP 12288:Eq14BlXN3B44aZKwRFyR3oYVkWY04v2yItybWaDC:ElXJGjMwRFyKYVXX4oybWmC
TLSH
T156C402A42BB8CA13F780AA38F1E0F77DAB74EEA81E42D61356E93D4F75353655C24102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb.exe
- Size 571KB
- SHA256 11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb
- MD5 693d96e5e78e84dffa825682015ed434
- SHA1 e4c82332c18ec8204e754fdf39119f02735adea5
- SHA512 8758bf347a123607f5ca7c1beeff4368f99f8dd4dd9fc094937665ee5c9bb0fe31915b7dc15c0101c57a347fc4e21db8310a8c5f5dd340b56b5441426dd01584
- SSDEEP 12288:Eq14BlXN3B44aZKwRFyR3oYVkWY04v2yItybWaDC:ElXJGjMwRFyKYVXX4oybWmC
- TLSH
  T156C402A42BB8CA13F780AA38F1E0F77DAB74EEA81E42D61356E93D4F75353655C24102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader execution guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Banner.dll
- Size 4KB
- SHA256 f0339333b6fc5e1535fda3663d75eb221f360da6121942ff41411c1d64020de6
- MD5 10a95c6950140ca851e3e72d74553677
- SHA1 dfeda48e6c8ea40217689b4057cc187482a1ece5
- SHA512 b72b6120835e7fe24d415464d44300c7919f6f08501ed045c12b5bc7f53747e87c99a96069b8f84397ae7858d839d75474f9644229307ef5d039d630da10df25
- TLSH
  T1C481853BB2F04EF7E563023300831BD325ABE9146B28461E4967A1ED764A9D7D53CB02
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
- MD5 0d45588070cf728359055f776af16ec4
- SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
- SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
- SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
- TLSH
  T1E412F793E5A820B3C2D3533F35BE2B2EC7B95335B0512C0482739A497A6947A6E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6