guloader | 476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82

General

Target
476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82.exe
Size 339KB
Sample260810-spmg9sbr81
SHA256 476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82
MD5 a6d9343937044aa2bbd88242d974ce2c
SHA1 40d33bf4f95194808ba18b5d818810c3026a5c32
SHA512 cae7e5f1c44ed23fe7c336508915388b7f267ecd10189496653ed3f47d379ebb5f99e3e1b8411851176048a8877a7f612f2f6789e4dbdd4efc053fa29fc1fc5b
SSDEEP 6144:AicFyQyEBErg9v0jhbq9IBszA6xXu+Mh9rdRYjZIdLgliE:rgEcx0jhbq91nxe+O9rdRY+6r
TLSH
T1F974F141B780A667D5F14E7359A7CB725372AF754702470BE394732B3EF22839B0A288
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82.exe
- Size 339KB
- SHA256 476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82
- MD5 a6d9343937044aa2bbd88242d974ce2c
- SHA1 40d33bf4f95194808ba18b5d818810c3026a5c32
- SHA512 cae7e5f1c44ed23fe7c336508915388b7f267ecd10189496653ed3f47d379ebb5f99e3e1b8411851176048a8877a7f612f2f6789e4dbdd4efc053fa29fc1fc5b
- SSDEEP 6144:AicFyQyEBErg9v0jhbq9IBszA6xXu+Mh9rdRYjZIdLgliE:rgEcx0jhbq91nxe+O9rdRY+6r
- TLSH
  T1F974F141B780A667D5F14E7359A7CB725372AF754702470BE394732B3EF22839B0A288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- TLSH
  T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- TLSH
  T156120992E6A450B3C5E6133F35AA2B2DCBBD5325B0922C0083738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6