guloader | 76ad562030026b0847ffe2ffd91713a828fa924e5a9c74550ed206b0c134dd12

General

Target
3.gz
Size 187KB
Sample260814-kv1cbage73
SHA256 76ad562030026b0847ffe2ffd91713a828fa924e5a9c74550ed206b0c134dd12
MD5 2a0f306f4f14fb4c41c85ecb405ffaa0
SHA1 cd33fa0ae4a9c03cb69feaa70ec5fbd119c2ee44
SHA512 d986a153415ebf35b6687efea54a08acee84aedc9c68caa99969cd6c7ad079b20005473a9ff17feb6fe00ea5ffcb11abf59225c6360994c910c8ef774555ffdc
SSDEEP 3072:g+dJ9O4eUOXxFNAy6x6Q0jKNrDutkCXHo+LrLZtIC36hGRpPOqhkR:9J9qFIx6Q/futC+LrTzzpLK
TLSH
T15214232DB3A5048DD03913D153DEECEDE2D4080AA2B7CB66C2307653701D927EF979A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Paymeanto14082600008976.exe
- Size 258KB
- SHA256 0e0bca2b782fb3d91cfe6c3dd55a59226f1b6b4e20453aebc34db216c5c0a81a
- MD5 c5a32a7a16d32f960b7387fc25ee7372
- SHA1 f7f9b71363f3ba30282cf093141164710a991463
- SHA512 466f929b4506a60cb93cc50387349c04d24ee5091f164c163b86d81ba798ff646005f44904192bd16c33d25f142476b92b5fda43253ed351e0f618541ab189e8
- SSDEEP 6144:ZgORaeCymGj9G8aZdy3mmEf0tq+RrZ3zpIs0:Zgquy3mmEfyqurZ1d0
- TLSH
  T10444BE1631008296E82844F2C017C9B65B627C7615A74D8B32B1FF6F797F6A2FA27D13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- TLSH
  T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c719697d5ced17d97bbc48662327339ccec7e03f6552aa1d5c248f6fa5f16324
- MD5 ca5bb0ee2b698869c41c087c9854487c
- SHA1 4a8abbb2544f1a9555e57a142a147dfeb40c4ca4
- SHA512 363a80843d7601ba119bc981c4346188f490b388e3ed390a0667aaf5138b885eec6c69d4e7f60f93b069d6550277f4c926bd0f37bc893928111dc62494124770
- SSDEEP 96:ojsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3Y/NqkzfS:ojsvWyNO81b8pCHFcM0PuAgkOyhIFc
- TLSH
  T1FE12F892E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39395BA6E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6