General
- Target 3c63a3c0670132e07fb90ca3c29ba35d898f6293bd40619a5611cb705e8b8212.exe
- Size 903KB
- Sample260810-tx551ssgqc
- SHA256 3c63a3c0670132e07fb90ca3c29ba35d898f6293bd40619a5611cb705e8b8212
Score
10/10
Malware Config
Targets
-
- Target 3c63a3c0670132e07fb90ca3c29ba35d898f6293bd40619a5611cb705e8b8212.exe
- Size 903KB
- SHA256 3c63a3c0670132e07fb90ca3c29ba35d898f6293bd40619a5611cb705e8b8212
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target Rockendes.Pot
- Size 54KB
- SHA256 5a14f9c07c8a4e4bd81a2dfef920c89710c485e586a61aa5bfac114cb59ab61d
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1