guloader | bf591aea1718997f89e943b541551256412077bd6ca83c39cd261ec88aad4dcd

General

Target
bf591aea1718997f89e943b541551256412077bd6ca83c39cd261ec88aad4dcd.exe
Size 211KB
Sample260910-m933vssbqh
SHA256 bf591aea1718997f89e943b541551256412077bd6ca83c39cd261ec88aad4dcd
MD5 e4cf5fdf4834690117082734247d829b
SHA1 e0cf552aa355a1bed0be469a483e9f9d6f027fe5
SHA512 4f28fe98f5a7ec19463af6f8fd746c4248d55e535c9bd1facfbee5aea72535663f8c0767b58ac7f9504bc7eaafbc29f14aaba932a082c109b35338f98b0225a6
SSDEEP 3072:QNRCywDw1DiJkuqh1ZtgmTQXGt+8lZ+VQiGznI+UcophRMPRdM5Bo/lNYkSe4PcE:QT4DteltggQCWV1wnIzpUPRa4PYkTk
TLSH
T14A24D005B2128126CEA50A304C23667F6EA59E9E3C705B3F5F30FE477E79EC29909356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  bf591aea1718997f89e943b541551256412077bd6ca83c39cd261ec88aad4dcd.exe
- Size 211KB
- SHA256 bf591aea1718997f89e943b541551256412077bd6ca83c39cd261ec88aad4dcd
- MD5 e4cf5fdf4834690117082734247d829b
- SHA1 e0cf552aa355a1bed0be469a483e9f9d6f027fe5
- SHA512 4f28fe98f5a7ec19463af6f8fd746c4248d55e535c9bd1facfbee5aea72535663f8c0767b58ac7f9504bc7eaafbc29f14aaba932a082c109b35338f98b0225a6
- SSDEEP 3072:QNRCywDw1DiJkuqh1ZtgmTQXGt+8lZ+VQiGznI+UcophRMPRdM5Bo/lNYkSe4PcE:QT4DteltggQCWV1wnIzpUPRa4PYkTk
- TLSH
  T14A24D005B2128126CEA50A304C23667F6EA59E9E3C705B3F5F30FE477E79EC29909356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
- MD5 a1da6788aeaf78ca4ae1dece8019e49d
- SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
- SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
- SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
- TLSH
  T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4