guloader | 15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04

General

Target
15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04.exe
Size 260KB
Sample260801-eb95hsdp9x
SHA256 15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04
MD5 a1b82f225e543e784438fec0fe7b5b28
SHA1 234eade4317f742c743f67c5c85952f49a63fdfb
SHA512 fc247edaaa13775a8124170b5e5d67320eb73cc87654c4c5eee972ff2d036861e2a37dbcf5635ec29d6049ff8dbcbd2afe0715dc98a86736053668c53109b35a
SSDEEP 6144:vMm4CCAd/4TGMXA6w+WjYdpQxItQhUY9w39ZZCS9WoUduv:vMw1d/o7XA6w+WIpjGhvOZvWoUdI
TLSH
T18B44028477D8D04FC16690701917ABBB6F6BFC5C1435824B2B34AF9D7B3A2C2692B391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04.exe
- Size 260KB
- SHA256 15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04
- MD5 a1b82f225e543e784438fec0fe7b5b28
- SHA1 234eade4317f742c743f67c5c85952f49a63fdfb
- SHA512 fc247edaaa13775a8124170b5e5d67320eb73cc87654c4c5eee972ff2d036861e2a37dbcf5635ec29d6049ff8dbcbd2afe0715dc98a86736053668c53109b35a
- SSDEEP 6144:vMm4CCAd/4TGMXA6w+WjYdpQxItQhUY9w39ZZCS9WoUduv:vMw1d/o7XA6w+WIpjGhvOZvWoUdI
- TLSH
  T18B44028477D8D04FC16690701917ABBB6F6BFC5C1435824B2B34AF9D7B3A2C2692B391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
- MD5 48f3e7860e1de2b4e63ec744a5e9582a
- SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
- SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
- SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
- TLSH
  T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6