Overview

overview

10

Static

static

3

1355a9f437...ab.exe

windows10-2004-x64

10

1355a9f437...ab.exe

windows11-ltsc_2024-x64

10

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
  • Size 609KB
  • Sample260810-t1ataayse1
  • SHA256 1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
guloaderdiscoverydownloaderinstaller

Malware Config

Targets

    • Target
      1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
    • Size 609KB
    • SHA256 1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverydownloaderguloader

    • Family: Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/AdvSplash.dll
    • Size 6KB
    • SHA256 5e71559df5cbcc4d98ebd9d4ddffabe18b047f9a50d98a96e46a4c0ac589105c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 495bddc0be6e18e981db82fab9d1de55c7e269ab4ec3ff43035193bc017a307b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v16

Tasks