General
- Target d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9.exe
- Size 683KB
- Sample260801-k44fbsge33
- SHA256 d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9
Score
10/10
Malware Config
Targets
-
- Target d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9.exe
- Size 683KB
- SHA256 d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Fibrolitic.Big
- Size 53KB
- SHA256 2a07a75f46c3581a3d4c8476ccd99d5bfc245068e8ccf8c63062c8ad454f2667
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.