guloader | cbdff40bf525a8fdbb771e23e9da6463a380c7e6264236226a9909c8bc141889

General

Target
cbdff40bf525a8fdbb771e23e9da6463a380c7e6264236226a9909c8bc141889.exe
Size 447KB
Sample260810-t5dqqstalb
SHA256 cbdff40bf525a8fdbb771e23e9da6463a380c7e6264236226a9909c8bc141889
MD5 19ff75be2db21319ad41eb100087f046
SHA1 6bd32a4812f05876fb5279393d7858dae6515e73
SHA512 9d886a523655a7c06262e35db07468ee245d2b49933f8322b38edfb627a407ebb1491e44fa92d71394f8419de70da99e9d429895d5204da977387ac97f7ec28f
SSDEEP 6144:eT4DtqvsmZEajninlk5v4RgGqohsGtiVssJ8szRdCVkeGkVqEsafxYjYmr/dt:eTLpZEEns6vOqOsVss6b0aqEsapYNdt
TLSH
T1B0A4024533A4E273C07D06718C2A8B632B36DC755BD16F1B3354B74E6DB22824A7BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  cbdff40bf525a8fdbb771e23e9da6463a380c7e6264236226a9909c8bc141889.exe
- Size 447KB
- SHA256 cbdff40bf525a8fdbb771e23e9da6463a380c7e6264236226a9909c8bc141889
- MD5 19ff75be2db21319ad41eb100087f046
- SHA1 6bd32a4812f05876fb5279393d7858dae6515e73
- SHA512 9d886a523655a7c06262e35db07468ee245d2b49933f8322b38edfb627a407ebb1491e44fa92d71394f8419de70da99e9d429895d5204da977387ac97f7ec28f
- SSDEEP 6144:eT4DtqvsmZEajninlk5v4RgGqohsGtiVssJ8szRdCVkeGkVqEsafxYjYmr/dt:eTLpZEEns6vOqOsVss6b0aqEsapYNdt
- TLSH
  T1B0A4024533A4E273C07D06718C2A8B632B36DC755BD16F1B3354B74E6DB22824A7BE26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4