guloader | 6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977

Sharing

Copy URL Twitter E-mail

General

Target
6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977.exe
Size 923KB
Sample260810-w2d87ser61
SHA256 6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977
MD5 e284ccddd64249cfb245162695ce745e
SHA1 5cff20e7494330cf92982dbe4d919acccc982b74
SHA512 c95aea98c5080bcc03739460da98ef257d3a6bb3c2dded2967c6eeac635ce06283b126d01dda974bd662fa111ffd066391548aab9c141a072059f91dc603e1aa
SSDEEP 24576:IMwLwUUfyoKLT9aBVob8///jY7aKJ3Q/JJxiRskCocB8He:IMwLwPyoKLTiVA8MyAOB8He
TLSH
T1221512417B5C841FC1B405B694B2E29A6BB4ACF0147C93173E397A2F5C383939DAAF16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977.exe
- Size 923KB
- SHA256 6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977
- MD5 e284ccddd64249cfb245162695ce745e
- SHA1 5cff20e7494330cf92982dbe4d919acccc982b74
- SHA512 c95aea98c5080bcc03739460da98ef257d3a6bb3c2dded2967c6eeac635ce06283b126d01dda974bd662fa111ffd066391548aab9c141a072059f91dc603e1aa
- SSDEEP 24576:IMwLwUUfyoKLT9aBVob8///jY7aKJ3Q/JJxiRskCocB8He:IMwLwPyoKLTiVA8MyAOB8He
- TLSH
  T1221512417B5C841FC1B405B694B2E29A6BB4ACF0147C93173E397A2F5C383939DAAF16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader persistence
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/BgImage.dll
- Size 7KB
- SHA256 73abbc57661987e7a0aa7e43f6d7dcff63a74615d3b731d94891b05e0e19adcb
- MD5 e2834a37c23a5c487b6e3a55eb95dd8a
- SHA1 2ebc683fe079a8b0081283fd4adfff82f52dfa4d
- SHA512 c78edd37a46db20f56bffcc63358bde32b61552bc2e1e0960a41d36a84795e6d7fa4bb523ca1f1995ea62c60c8060cbadd5764d3a133de4ccac7501e68075e68
- SSDEEP 96:8enk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTG4j7J3kWyy/:tkTJa2roqJyA2EN8diuT3je
- TLSH
  T1DAF12B337AC26073D3F582F42D92116DDBFA6D156324A59D0B3721E86D60AE3E84CB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 933f93a30ce44df96cbc4ac0b56a8b02ee01da27e4ea665d1d846357a8fca8de
- MD5 98ff85b635d9114a9f6a0cd7b9b649d0
- SHA1 7a51b13aa86a445a2161fa1a567cdaecaa5c97c4
- SHA512 562342532c437236d56054278d27195e5f8c7e59911fc006964149fc0420b1f9963d72a71ebf1cd3dfee42d991a4049a382f7e669863504c16f0fe7097a07a0a
- TLSH
  T1888164BB93E00DF3D0944B7B44A71CE762B5DD301762001F0A478A992590B67ED7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
- MD5 48f3e7860e1de2b4e63ec744a5e9582a
- SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
- SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
- SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
- TLSH
  T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10