guloader | dc4741b69e9d2ff256f83e2a1d9ec305649c42078c633b5769bfbde05f999d20

Sharing

Copy URL Twitter E-mail

General

Target
2020-04-19.zip
Size 7.4MB
Sample260710-ag1qtact5z
SHA256 dc4741b69e9d2ff256f83e2a1d9ec305649c42078c633b5769bfbde05f999d20
MD5 20c39ac1a725ab85cc511dd9ad43077f
SHA1 ba9b66ac42cb35d43dc731b87b20e27df7ab0c8d
SHA512 14459d385750480bb131f9b5f1932788ba89f8b60c45da57466be2c25edffafa0fabb78c3c8399dc19af3c92f4e63232b06fa2810cbcda1ca22a36e8d9351606
SSDEEP 196608:CiB11L4VZHo42mpWsdGlDiFHmyQTP7fTx1y:NlLCJo4ZpWsdE+Ffgfjy
TLSH
T1DE7633397B7EE05568401740B12A918BE12784F6CBEB768E49B51C961C93D8FE3E0F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=1A2GiKoBaxf4TURuyOtfp2JNU3ZJfXn8O
https://drive.google.com/uc?export=download&id=1uYpTyj0BNHKsGuykkGb8JS43xlUskyyP

xor.base64

Extracted

Family

wshrat

http://megamoneyaneke.duckdns.org:1104

Extracted

Family

xloader_apk

https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

Attributes

user_agent
Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Extracted

Family

xloader_apk

http://91.204.226.105:28856

DES_key

Targets

- Target
  14d9d472a7d754f0ee6f6eeb38f1f41e768e31cf02474d805c96a507425fe57f.elf
- Size 37KB
- SHA256 14d9d472a7d754f0ee6f6eeb38f1f41e768e31cf02474d805c96a507425fe57f
- MD5 1a79167227e77041263a8970f9debcd6
- SHA1 ae50192b5ae980baa85530641398de3ef60219c7
- SHA512 eb6871ca2a8b5285d94d8ae277849c16b8a1235ceb6850127a41dadd9edd1c0a5b1d70ef089a09830313927fba45b00138d2d459d826566df569985d64089f9f
- SSDEEP 768:jSnGKgWNh6a79rd2Zm7blvjLPMG7r2aLMX1IJkD+NQkUNTE3Uexk:mnGKLhNBd2elvjJLMX1IJg+qgk
- TLSH
  T12103F132974B6066C4B04CF6E5E9030473DD03B48CAB3116DB5A6F445DF76ED2BB0968
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  237cef77ab6827cd25f2b554b6968ad854b61e0d117dafaaaa12e524fdba7c07.elf
- Size 39KB
- SHA256 237cef77ab6827cd25f2b554b6968ad854b61e0d117dafaaaa12e524fdba7c07
- MD5 1a62ce33f530f40ac0afba4f046081d5
- SHA1 3fd75c4f1dff259c3fa78bb33dbddbc2c6c3334f
- SHA512 19e1bc1d373f4eb17f1138bc6029186ba67d81bd0f8e6db4790d4510c60bb8e62de01df8443b41e218acf7c28fd322b5dea6e2a9ec8d565af6ce74acca54a73e
- SSDEEP 768:Zz4GVrDhX4AZ9CT7XlKQVbrEo/elS9ZtcfKi+d/uQ8oW8YAPYP2PaY/G2q3U7KR:ZzfrDt8T7luozd+Kj21oW8YuSY/i
- TLSH
  T16E03E1A161033497D1F0A2B9FAD711C3F2895ABCB1D6348037869B99F9A6607F055C17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  PO19AC070165.exe
- Size 100KB
- SHA256 a3c9b063a2e0b2543b34146f01d970f5ea721fac3fccc95bf1afdac5a56164e9
- MD5 cc337525b1812296df853fd61fb0090f
- SHA1 f8d642e49c6de86156a09f72b838af2a3c31518d
- SHA512 f60e61230d117718b7ceec7a14ef533f590ada067ceee736cf9992629ece18ff814d31d9d0ed84e6663a7d40e7740598a8790f3e35075d92282b05156c21f6ab
- SSDEEP 768:uFTA7r51cr4vGqcw11XkCHsz43gwG305kcwJvxjDx7AMaFf9fb6BoFVqRHNo0e9G:qur516Srkks03lwJvncpORfe8Zz
- TLSH
  T153A3F660B694FE81D4244AB18A76D3EC4072FC35CD426A4B35C43F0F7A79985B9A2F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  5463a0d800c63885b35bd19952d00f97dced5e8d926c4d3e121dcd338d7d7e97.elf
- Size 105KB
- SHA256 5463a0d800c63885b35bd19952d00f97dced5e8d926c4d3e121dcd338d7d7e97
- MD5 e1f3d135915d461a9d8e684b3f64108a
- SHA1 5fba1de26537174ac7eef37f3e7390e367846a0f
- SHA512 389bb3262f355a0b513e6edd9752f4ecff0d662dc55ab97ef733ca10a7199c441abd48506bbda335e2651270fb78a76bb34b15b42391a87d99f1156b5948a64a
- SSDEEP 1536:3aQiZDMyqIlMBZ/R0F4E4kcHiNq98wk9njKZjjLuYo68864sNHFEzv7Ld76divkZ:KzDMyqIMBZ/R0ufhBmgZy9yNsNmPtcZ
- TLSH
  T13CB312A3FB6DCA9FE8711F74DEFC367BBF1578E9C8087181D5241E265051224A324B86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Shipping Maersk AWB.exe
- Size 100KB
- SHA256 ef0f27aded70c29415263833915d973bfe7c3aa399ba19d44fde195276fc4e8f
- MD5 dee4977684fa55f729571c25c975e101
- SHA1 2e90900bc501819de971b5cc16350c54f76e44c3
- SHA512 e7b0fe640358c93030e8656bb72e609b3a971fc3caddd010f8ccdc7a30d5a207f987cabdc5a8d65f9682944020ad4aeea25da6f2d080265c71b2ec00f0d24026
- SSDEEP 768:iOtXJfJF3mvyFk02edljwkcbN5/qBopqMul+gtoceRWtW9GHxKp:HtXJfJF3R7YPN5/qN+ye4s9GS
- TLSH
  T137A30723B5A4FDA1D11446B59A7BC7EC0565FC30CD01AA0B34C43F2F2A7AA85B162F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader persistence
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral6 behavioral7
- Target
  DHL Delivery Document.exe
- Size 108KB
- SHA256 785fe172fa75793094ba5554b934534a1aa3611d76043154bd1e13d6b50f841f
- MD5 7b4e8d64419bb22f45979a4b3662b22d
- SHA1 31f75bcbb0556e2526a7cf167cd9734960ea8552
- SHA512 30807a53415e3e570b58f2611f544d03dae11bdb8f6f5f3ffc46e23a77444c93124bcd6a7a148cfb07221cdf8629d678b7ab96d19d2601ff3d7d2fa8d630d150
- SSDEEP 768:ibhwMXFKyL+OiNVXjcTa+XtaMFghrfkHS8bx0k16m6kSbgbcYGOT61sex:IXFKyLGcm+XtaMsl8bx0k16mXSbgQ5L
- TLSH
  T11DB319547294FE53C1294672AE76C7FD0469BD308C046A073AC93F0F2EB69857562F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral8 behavioral9
- Target
  6a53ac8d1b891a99e7b12f1a4fbb1664b766ae57aa898b52fda7860b465a94e2.elf
- Size 60KB
- SHA256 6a53ac8d1b891a99e7b12f1a4fbb1664b766ae57aa898b52fda7860b465a94e2
- MD5 75776c5d20ed1a3a8156e7ca59e11f9a
- SHA1 276549002d2009a4608c12cef60987649bd0bb30
- SHA512 d9ae422a3857ea68af680b893fdcc68d453c1822c4946863947dca1e665e75380bda94fb86f9018e2084ed8b12d88a5d7116b70fab278af0a4e8c74807e995f6
- SSDEEP 1536:7DP2ITxKdOQZIrXcrCz3cO4lIv392sYDIwqaIV7eZ7U646DU8BXa:7TxIOoQqCDcmFH2/q6Z7zdU8s
- TLSH
  T1BA530236D40D1E32F8A18EBDD4F766445ADA0F7DD08E31C61240E725FEA748689790DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral10
- Target
  SOA.exe
- Size 100KB
- SHA256 a3c9b063a2e0b2543b34146f01d970f5ea721fac3fccc95bf1afdac5a56164e9
- MD5 cc337525b1812296df853fd61fb0090f
- SHA1 f8d642e49c6de86156a09f72b838af2a3c31518d
- SHA512 f60e61230d117718b7ceec7a14ef533f590ada067ceee736cf9992629ece18ff814d31d9d0ed84e6663a7d40e7740598a8790f3e35075d92282b05156c21f6ab
- SSDEEP 768:uFTA7r51cr4vGqcw11XkCHsz43gwG305kcwJvxjDx7AMaFf9fb6BoFVqRHNo0e9G:qur516Srkks03lwJvncpORfe8Zz
- TLSH
  T153A3F660B694FE81D4244AB18A76D3EC4072FC35CD426A4B35C43F0F7A79985B9A2F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral11 behavioral12
- Target
  738439de213940075eb1b8a1221197e303da1fc1fa9e4a68c5bb1d805d447ad1.elf
- Size 33KB
- SHA256 738439de213940075eb1b8a1221197e303da1fc1fa9e4a68c5bb1d805d447ad1
- MD5 7e0c04f9215584f286006e9b358ee3d9
- SHA1 3ef830c4c8492baa73f9ada754c30f1f0f453c0b
- SHA512 833dd9fc20257b835f1896adf4322dd6b100935f1a06d777fc18749c8bd08f64f3dda15a2527b16b01190915a19936cf289b5113a56cd63ba5a43c26ef7395be
- SSDEEP 768:xioSMe0hu25XMNg0OqAlKxDhgnfR8CqVrKv3Up:xiiDs258NvOqAoxCIWg
- TLSH
  T11FF2E1044361A8B04FF02477DCBE0B0C17F7946DEA5A356AAB21E9A464C709AD8BDF46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  785fe172fa75793094ba5554b934534a1aa3611d76043154bd1e13d6b50f841f.exe
- Size 108KB
- SHA256 785fe172fa75793094ba5554b934534a1aa3611d76043154bd1e13d6b50f841f
- MD5 7b4e8d64419bb22f45979a4b3662b22d
- SHA1 31f75bcbb0556e2526a7cf167cd9734960ea8552
- SHA512 30807a53415e3e570b58f2611f544d03dae11bdb8f6f5f3ffc46e23a77444c93124bcd6a7a148cfb07221cdf8629d678b7ab96d19d2601ff3d7d2fa8d630d150
- SSDEEP 768:ibhwMXFKyL+OiNVXjcTa+XtaMFghrfkHS8bx0k16m6kSbgbcYGOT61sex:IXFKyLGcm+XtaMsl8bx0k16mXSbgQ5L
- TLSH
  T11DB319547294FE53C1294672AE76C7FD0469BD308C046A073AC93F0F2EB69857562F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral14 behavioral15
- Target
  80bec8a750a9247eba493dd658df038f191eed8d16e259536f911bbf9f6cffd7.elf
- Size 39KB
- SHA256 80bec8a750a9247eba493dd658df038f191eed8d16e259536f911bbf9f6cffd7
- MD5 37f1aae0b0ccc89cde62bc8c9cd26693
- SHA1 c1604bb0268074d970c328d6620340facd32bb2e
- SHA512 2ee00ff2d9a495bd2d1d3d23ef945b4c8b02c3abf411f39cb207eb0240bd6c4141bb036b378ac626d724e35d825bc94758739f693f2eece71a9765644683201d
- SSDEEP 768:4nFv6uj8IgwUiNsRgxzMlh2gVnNSY+cftFXJgGlzDpxYsjR:mFv6ujwwkgxzys0kY+4FVVrYW
- TLSH
  T19E03E13E2B4E01BAD5124AF84E4743F64E7D4EE07055F9073769B4A689270FA74329F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  IDC202001281QA REF DCF TRANSFER.js
- Size 224KB
- SHA256 952e92df20c27b35f7236e6ea2ffa867d289fc32f39670042e4fdc0ae1c5a11a
- MD5 7889ff3dc241eaf41349fa48c6eab40d
- SHA1 45b14111a86db7e7e6eb5a9b1fb6a76f9fb7ace6
- SHA512 6b8b0eb6d350342f839def4e413f8588c0ccb4af35a0ebae4447663a4278490bfa09037f285c253115240124515b43a7e40af1f498c96177ac12b3b07bd60a3e
- SSDEEP 6144:RFPAeRpBvRL4BAklgF2GuuZBRTD1kdrlIs+:RTrJhSl0292VD1OrO
- TLSH
  T1DA247BF25B42FCBA636E1E94B02CA511FC982D0B5EC74D4CEAC07891286D261FED95F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution wshrat persistence trojan
- Family: WSHRAT
  WSHRAT is a variant of Houdini worm and has vbs and js variants.
  trojan wshrat
- WSHRAT payload
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral17 behavioral18
- Target
  952e92df20c27b35f7236e6ea2ffa867d289fc32f39670042e4fdc0ae1c5a11a.js
- Size 224KB
- SHA256 952e92df20c27b35f7236e6ea2ffa867d289fc32f39670042e4fdc0ae1c5a11a
- MD5 7889ff3dc241eaf41349fa48c6eab40d
- SHA1 45b14111a86db7e7e6eb5a9b1fb6a76f9fb7ace6
- SHA512 6b8b0eb6d350342f839def4e413f8588c0ccb4af35a0ebae4447663a4278490bfa09037f285c253115240124515b43a7e40af1f498c96177ac12b3b07bd60a3e
- SSDEEP 6144:RFPAeRpBvRL4BAklgF2GuuZBRTD1kdrlIs+:RTrJhSl0292VD1OrO
- TLSH
  T1DA247BF25B42FCBA636E1E94B02CA511FC982D0B5EC74D4CEAC07891286D261FED95F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution wshrat persistence trojan
- Family: WSHRAT
  WSHRAT is a variant of Houdini worm and has vbs and js variants.
  trojan wshrat
- WSHRAT payload
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral19 behavioral20
- Target
  a592b85c9e49fe82672d870731879dd7708c474b74815cf06ad75d0df9e4c647.apk
- Size 274KB
- SHA256 a592b85c9e49fe82672d870731879dd7708c474b74815cf06ad75d0df9e4c647
- MD5 20164ee1b173d45b1df0696250fc0076
- SHA1 e964141effbb5e08a49f609e0f74df3797b6cc61
- SHA512 1e97345311854578b9e435792fb547e3af6b1b26ec92ef0af3d35cf94cd9d65bc0e5b035cc69ed99e83edd00b195fb2751c1055935d7ef8c6829bddc79f7af50
- SSDEEP 6144:r1Lfv65atsRJ3f2bESvmgPz+0YDXfWu3e0GN:rNf3jE0LlYDXfDeR
- TLSH
  T12354235518F8966EE5434D76325351AA18AC0C9A9FFE3509BC902860FE1E8E16F40DFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection defense_evasion discovery evasion xloader_apk impact infostealer persistence stealth trojan
- Family: XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- XLoader payload
- Checks if the Android device is rooted.
  defense_evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests changing the default SMS application.
  collection impact
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral21 behavioral22 behavioral23
- Target
  REV -PROFOMA INVOICE NO2020TD24.exe
- Size 100KB
- SHA256 a3c9b063a2e0b2543b34146f01d970f5ea721fac3fccc95bf1afdac5a56164e9
- MD5 cc337525b1812296df853fd61fb0090f
- SHA1 f8d642e49c6de86156a09f72b838af2a3c31518d
- SHA512 f60e61230d117718b7ceec7a14ef533f590ada067ceee736cf9992629ece18ff814d31d9d0ed84e6663a7d40e7740598a8790f3e35075d92282b05156c21f6ab
- SSDEEP 768:uFTA7r51cr4vGqcw11XkCHsz43gwG305kcwJvxjDx7AMaFf9fb6BoFVqRHNo0e9G:qur516Srkks03lwJvncpORfe8Zz
- TLSH
  T153A3F660B694FE81D4244AB18A76D3EC4072FC35CD426A4B35C43F0F7A79985B9A2F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral24 behavioral25
- Target
  b8066b7ec376bc5928d78693d236dbf47414571df05f818a43fb5f52136e8f2e.exe
- Size 21KB
- SHA256 b8066b7ec376bc5928d78693d236dbf47414571df05f818a43fb5f52136e8f2e
- MD5 053ec539c138afb99054bd362bb3ed71
- SHA1 d87847810db8af546698e47653452dcd089c113e
- SHA512 b0c6fc814e8c768d920892a769a7f7892a1033fb67eecff45ee811d5efae07a0832051db0d398db106460819a4fc0f87f85b9b1f74e56256a72c0c89cf7188e0
- SSDEEP 384:iXsE9x6/+iTvHPPwSDD37+1dBthRt+GN3eNstwsNdS5NeqHLa63W90N2g3TBGfZM:iXh9+RsnENLu63646pKgjQ
- TLSH
  T1D3A23C5326F4BE01FFF226B025E494238F78F6925E35CDEB8D0080185A64A83ED75A87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution impact ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Sets desktop wallpaper using registry
  ransomware
behavioral26 behavioral27
- Target
  DOC (8).exe
- Size 108KB
- SHA256 6070da383c3df420a2b864043a4e47c25f5b35f2f0583a9d997db9a40b9cda93
- MD5 e88e3bd087eb8fd64af97b9de9ecf0ac
- SHA1 44cace2505aacddac5fb379a38b0e40c16a2af44
- SHA512 073dbd3c1e311b6e1a8725213fa44b1b06cfe5226c0ecbb743e5d8fbb9a13b31bd861a743e9737bdd2d94001b2cc13191bea15bda73b6c35d31928e97fbfa853
- SSDEEP 1536:kn+bYoWxZQ38xG0jrfaaMGLKagd9KSplJMVRiAPtK:kGFW/31fYBpb+/K
- TLSH
  T1F1B329217994FF01C52586329E7AD7F8445AFC348910AA433AC43F5F3A7998178A2F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral28 behavioral29
- Target
  SWIFT-MT103.exe
- Size 100KB
- SHA256 a3c9b063a2e0b2543b34146f01d970f5ea721fac3fccc95bf1afdac5a56164e9
- MD5 cc337525b1812296df853fd61fb0090f
- SHA1 f8d642e49c6de86156a09f72b838af2a3c31518d
- SHA512 f60e61230d117718b7ceec7a14ef533f590ada067ceee736cf9992629ece18ff814d31d9d0ed84e6663a7d40e7740598a8790f3e35075d92282b05156c21f6ab
- SSDEEP 768:uFTA7r51cr4vGqcw11XkCHsz43gwG305kcwJvxjDx7AMaFf9fb6BoFVqRHNo0e9G:qur516Srkks03lwJvncpORfe8Zz
- TLSH
  T153A3F660B694FE81D4244AB18A76D3EC4072FC35CD426A4B35C43F0F7A79985B9A2F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral30 behavioral31
- Target
  df9703a0d8c1d131522df55c5e566f64374c19f8db29aad37ecb7c5306185057.elf
- Size 39KB
- SHA256 df9703a0d8c1d131522df55c5e566f64374c19f8db29aad37ecb7c5306185057
- MD5 aff182dd6e30d4d5125ee23a6ff1cb0a
- SHA1 d30450ff32e454fbe93674851b30da14c482fda9
- SHA512 881c72a61faf93f389b4ceb3c2c845c405d7de1016dd33bb0e40f38c9c687bb302b07bf4537f09eae57f2f996ace4761cc1bd9e386106a25669a2f6c3a6c1b8a
- SSDEEP 768:LLYswiPo9qP4HpvCsV0vMNZsXdgCiQUrkqpcdPJgGlzDpxYsji:gGyqP4JvCsVVNgdHUj0NVrY1
- TLSH
  T10C03F21CD61A4D7BE91BC5FE364683510A668BF3A063E9067A5AC2D10F51818386BFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32