guloader | 8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05

Sharing

Copy URL Twitter E-mail

General

Target
8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05.exe
Size 1.1MB
Sample260825-cm348swclf
SHA256 8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05
MD5 0e410ab4a2b766f4fc198af2225e91c6
SHA1 df5f61e82a197cb7866f341b7941488156f002ee
SHA512 2ad2bc54634399ceefc34762960f668354f13d314daaef3518441912c9c2c9cff6cfeec375471a799bf7a87e3376c7d7e4035192459bcbe2278f7c9bc7c35f96
SSDEEP 24576:pBEhPidEmfaCqwW/w7MySAy3eQ5Ricod/10zfWed3NkHAU/:0hqdEmiBwZLNCeQfG/16fF3E
TLSH
T1E54512812E382DA5E69AC770AC336FB31B82FE767260C50EEB49D37E4174625644D13B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05.exe
- Size 1.1MB
- SHA256 8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05
- MD5 0e410ab4a2b766f4fc198af2225e91c6
- SHA1 df5f61e82a197cb7866f341b7941488156f002ee
- SHA512 2ad2bc54634399ceefc34762960f668354f13d314daaef3518441912c9c2c9cff6cfeec375471a799bf7a87e3376c7d7e4035192459bcbe2278f7c9bc7c35f96
- SSDEEP 24576:pBEhPidEmfaCqwW/w7MySAy3eQ5Ricod/10zfWed3NkHAU/:0hqdEmiBwZLNCeQfG/16fF3E
- TLSH
  T1E54512812E382DA5E69AC770AC336FB31B82FE767260C50EEB49D37E4174625644D13B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
- MD5 ca332bb753b0775d5e806e236ddcec55
- SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
- SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
- SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
- TLSH
  T1C3325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE20BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4
- MD5 904d8313031ac05e2bac3dd329828833
- SHA1 6c8322f76e5c38bc24b0bcc057a510c92ec40b43
- SHA512 9d524ebc965f224e1a16f537f71df0963c586fd548cb9a901f8afb1951416dd656d5493cc5e304157dfa6d70d69bcd4c5a5b140fceb3736548e71fe7086b6de8
- SSDEEP 192:oR8cxzvTyl4tgi8pPjQM0PuAg0YNyAUIFtSP:IBxzm+t18pZ0WAg0RzIFg
- TLSH
  T14812F793E5A860B3C2D3523F35BE2B2EC7BD5335B0512C0482738A497A6947A6E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Oversaetteren.esp
- Size 51KB
- SHA256 f6987c9debd36048de71534bf679238c8af3d19cc0c9e9eb40146ca7cda9b91c
- MD5 1a7aacd3f8b207ea0f287396bfe765f4
- SHA1 b97e7af1bf7492233520ae0f56312e0264410fff
- SHA512 4a2d194f849881a7cfc6ef2abbbd4285380516e7ce2ec60dea06c4a7de6d478b26bdd555e6985f79aa1d1bca9faee7d60bf0a5d0a076d5b14463b13b14c9fe96
- SSDEEP 1536:1m+dS6pg4I8eL96egR6NBknrsbncgktS/:A+dS6pg4I8eL96egR6NBknrsbncgktS/
- TLSH
  T132337D1D8FF51402455CF5FE2D4FC3D579B8EA7489648AB84BFB291EA38193D1880ABC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence ransomware adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8