guloader | 34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9

General

Target
34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe
Size 751KB
Sample260810-vb3y7sdl2v
SHA256 34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9
MD5 e541f3e3e4258f9c314141c4eae990d1
SHA1 812733251bb335680e3c3bf298a61b41a16155ef
SHA512 11923164a76a12c8c9c51b4ace0f47e49e562260bf86091dd5a615fbcabe7b846027a06500b40be47bd325df42cbfbef09214ed38403525f7faffa559aee57d3
SSDEEP 12288:TDGZKmormA1yB8sRQF3/naKqjMZyM9/NBtT9FWfRFpKdYLyHCf7neOQm8zKeGc0:1mor/1yBraBva3jMU6FBtT9OFpKCLyHS
TLSH
T190F4232713A8C067C1306330C917A7F2C9B05D96E46A9F831A12BD5E787B2D2693D7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe
- Size 751KB
- SHA256 34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9
- MD5 e541f3e3e4258f9c314141c4eae990d1
- SHA1 812733251bb335680e3c3bf298a61b41a16155ef
- SHA512 11923164a76a12c8c9c51b4ace0f47e49e562260bf86091dd5a615fbcabe7b846027a06500b40be47bd325df42cbfbef09214ed38403525f7faffa559aee57d3
- SSDEEP 12288:TDGZKmormA1yB8sRQF3/naKqjMZyM9/NBtT9FWfRFpKdYLyHCf7neOQm8zKeGc0:1mor/1yBraBva3jMU6FBtT9OFpKCLyHS
- TLSH
  T190F4232713A8C067C1306330C917A7F2C9B05D96E46A9F831A12BD5E787B2D2693D7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader execution guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 13ebc725f3f236e1914fe5288ad6413798ad99bef38bfe9c8c898181238e8a10
- MD5 1b0e41f60564cccccd71347d01a7c397
- SHA1 b1bddd97765e9c249ba239e9c95ab32368098e02
- SHA512 b6d7925cdff358992b2682cf1485227204ce3868c981c47778dd6da32057a595caa933d8242c8d7090b0c54110d45fa8f935a1b4eec1e318d89cc0e44b115785
- SSDEEP 96:s7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN838:UbGgGPzxeX6D8ZyGgmkN
- TLSH
  T140D1E7B832C20DF7D44D86743F22381717BDD47617B542A1CB932AD61EA2AE2FE21B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4