guloader | 53691285e3bd85e322a185b5b09864616d659c52c7057dc6c4b62a730d0a90cc

General

Target
53691285e3bd85e322a185b5b09864616d659c52c7057dc6c4b62a730d0a90cc.exe
Size 815KB
Sample260720-vd4cragx3n
SHA256 53691285e3bd85e322a185b5b09864616d659c52c7057dc6c4b62a730d0a90cc
MD5 8dc8aa043f246cfcdcf928738d331342
SHA1 56aebc496391b7bc8e8b9da831003e641ac2ba70
SHA512 1dccd7d727708b4c50c967b05461a85932cf33ef258559727d2655106bc77308683c2eac520f7091d06a311c887018cc9171a5d9e7729d6b5e6131f6f1b6733f
SSDEEP 24576:3g+x0oibOYUEduTTU4soffrNF/2r+TjpUEM4wo:3g+xutX67pHrNFerQ9
TLSH
T1AF052308B636D483E6A245301AAA8FFF0E959E176C384704B7757A4D3D31B90BD1F78A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot8102691496:AAGNZJkMazG1NBMKVKMi3L2F4T-kHg5Nll0/sendMessage?chat_id=7618581100

Targets

- Target
  53691285e3bd85e322a185b5b09864616d659c52c7057dc6c4b62a730d0a90cc.exe
- Size 815KB
- SHA256 53691285e3bd85e322a185b5b09864616d659c52c7057dc6c4b62a730d0a90cc
- MD5 8dc8aa043f246cfcdcf928738d331342
- SHA1 56aebc496391b7bc8e8b9da831003e641ac2ba70
- SHA512 1dccd7d727708b4c50c967b05461a85932cf33ef258559727d2655106bc77308683c2eac520f7091d06a311c887018cc9171a5d9e7729d6b5e6131f6f1b6733f
- SSDEEP 24576:3g+x0oibOYUEduTTU4soffrNF/2r+TjpUEM4wo:3g+xutX67pHrNFerQ9
- TLSH
  T1AF052308B636D483E6A245301AAA8FFF0E959E176C384704B7757A4D3D31B90BD1F78A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader vipkeylogger keylogger stealer
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Family: VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Guloader,Cloudeye

Family: VIPKeylogger

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4