General
- Target df8713d43b4799acade8e6240fab3dbb4063caa25c7b1d9aca326eb991f20968.exe
- Size 665KB
- Sample260831-m8ptvaga53
- SHA256 df8713d43b4799acade8e6240fab3dbb4063caa25c7b1d9aca326eb991f20968
Score
10/10
Malware Config
Targets
-
- Target df8713d43b4799acade8e6240fab3dbb4063caa25c7b1d9aca326eb991f20968.exe
- Size 665KB
- SHA256 df8713d43b4799acade8e6240fab3dbb4063caa25c7b1d9aca326eb991f20968
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Fernissages219.Cit
- Size 51KB
- SHA256 9556cf0b7464c14ede8f9ae4b9d1a20030beefd244d31fc36412603c82fbe2bc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.