guloader | 06da1c5c003d3efa258ac56a21ed9d4433c16496bc3bff0dd9fc0b13b5c109c1

General

Target
06da1c5c003d3efa258ac56a21ed9d4433c16496bc3bff0dd9fc0b13b5c109c1.exe
Size 440KB
Sample260727-axetaatcph
SHA256 06da1c5c003d3efa258ac56a21ed9d4433c16496bc3bff0dd9fc0b13b5c109c1
MD5 b4df6997da6509b4ba7a0c44a7c83723
SHA1 3ce85022f63992394954dab9dc48fe906a57b608
SHA512 0a7a6136df98f139039829d833840f6cc1c51e574f13df2899d663977e6d57c6656d9e04932dd82525f2ff4f94e7cff6309873c4e9e07de087c8130f39952b55
SSDEEP 6144:hT4DtIWmxram292Tm5zxrQlWzulLkY1GQ19ptVHc9tSH779NSmjscaT/2:hTma9ar76JHDFKt6XrBhaT+
TLSH
T1F8A4F1357B08D85BC5814DBD48E2EA9D71B0AD652E558B0373297F6FF838682EF1B204
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  06da1c5c003d3efa258ac56a21ed9d4433c16496bc3bff0dd9fc0b13b5c109c1.exe
- Size 440KB
- SHA256 06da1c5c003d3efa258ac56a21ed9d4433c16496bc3bff0dd9fc0b13b5c109c1
- MD5 b4df6997da6509b4ba7a0c44a7c83723
- SHA1 3ce85022f63992394954dab9dc48fe906a57b608
- SHA512 0a7a6136df98f139039829d833840f6cc1c51e574f13df2899d663977e6d57c6656d9e04932dd82525f2ff4f94e7cff6309873c4e9e07de087c8130f39952b55
- SSDEEP 6144:hT4DtIWmxram292Tm5zxrQlWzulLkY1GQ19ptVHc9tSH779NSmjscaT/2:hTma9ar76JHDFKt6XrBhaT+
- TLSH
  T1F8A4F1357B08D85BC5814DBD48E2EA9D71B0AD652E558B0373297F6FF838682EF1B204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- TLSH
  T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Spdbarnsudstyrenes157/Jugeredes.scr
- Size 29KB
- SHA256 227dfe10efdbe6dfed81a80af1fc3781194ba0b7a1fa89372e2d33f33bd176a5
- MD5 28f150459d9b4d1fbd7d89c64e500454
- SHA1 87e2ad0ec5537fe20ca7476c84f17d4a1bd9d857
- SHA512 dbb06d85dd5181affd39f9e0e66e2efc246cb8c600e70d9eb45b942a09e00df7b2f5708b09ea0b3a87bd4918bb28ce71f858f9e31001b9104c5a238357f26de1
- SSDEEP 192:yozXxZVUD/3nRaxcdYroPHAgzeKSaoKH7Id9M6QpH2MyAHa/lUW4FGtdS:XzVUz3s0eiz8aom1H2wHquW4FGrS
- TLSH
  T169D27D51019E90550BB0A4C46327CC7E7BA72B6C992E208EF47391794D98D2AAA98BD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6