Overview

overview

10

Static

static

3

e7b859fec4...48.exe

windows10-2004-x64

10

e7b859fec4...48.exe

windows11-ltsc_2024-x64

10

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

Ozonlamper19.app

macos-10.15-amd64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    e7b859fec462d1d13f2d288e9a8f53ca6c2231b4c6124d7ac8ee2b6d2e86a048.exe
  • Size 379KB
  • Sample260810-vl491sdn4v
  • SHA256 e7b859fec462d1d13f2d288e9a8f53ca6c2231b4c6124d7ac8ee2b6d2e86a048
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
guloaderdefense_evasiondiscoverydownloadermacos

Malware Config

Targets

    • Target
      e7b859fec462d1d13f2d288e9a8f53ca6c2231b4c6124d7ac8ee2b6d2e86a048.exe
    • Size 379KB
    • SHA256 e7b859fec462d1d13f2d288e9a8f53ca6c2231b4c6124d7ac8ee2b6d2e86a048
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverydownloaderguloader

    • Family: Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      Ozonlamper19.App
    • Size 45KB
    • SHA256 08af48339420250ac352b1686963ec59572245ad70f398a94e3a1f3cb47b3eb2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    defense_evasion
    behavioral7

MITRE ATT&CK Enterprise v16

Tasks