guloader | f27b7912dadad4dd5994ac78568169951f863ee86137ee8eb9f8c0d576ac39c6

General

Target
f27b7912dadad4dd5994ac78568169951f863ee86137ee8eb9f8c0d576ac39c6.exe
Size 230KB
Sample260910-mra95a1hnf
SHA256 f27b7912dadad4dd5994ac78568169951f863ee86137ee8eb9f8c0d576ac39c6
MD5 9b57d202499b4a2f753fb603ef985d7f
SHA1 8abe7ca04032a5cdf722052b2e2c8b1d5331d329
SHA512 eed633b2419b3c00c5dbd1d483de3115ad59999070639c99484533be029b708e0a6aea06b3af67ffb5d792375915a0c50d7b57d2a250ada2f492af329db8dbf2
SSDEEP 3072:2fY/TU9fE9PEtujwDX/0/hgF3S+kWo9gVVEGKfPKP44tO4CZFpV/I8SFqBlEl5Vx:gYa6twDX8paic3Ptg/9HGLZghA60teU
TLSH
T1D134F1107994E046C8520F704EBBD6F99964ADB46EF8D20F3390BB5C7FB13919A1A336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  f27b7912dadad4dd5994ac78568169951f863ee86137ee8eb9f8c0d576ac39c6.exe
- Size 230KB
- SHA256 f27b7912dadad4dd5994ac78568169951f863ee86137ee8eb9f8c0d576ac39c6
- MD5 9b57d202499b4a2f753fb603ef985d7f
- SHA1 8abe7ca04032a5cdf722052b2e2c8b1d5331d329
- SHA512 eed633b2419b3c00c5dbd1d483de3115ad59999070639c99484533be029b708e0a6aea06b3af67ffb5d792375915a0c50d7b57d2a250ada2f492af329db8dbf2
- SSDEEP 3072:2fY/TU9fE9PEtujwDX/0/hgF3S+kWo9gVVEGKfPKP44tO4CZFpV/I8SFqBlEl5Vx:gYa6twDX8paic3Ptg/9HGLZghA60teU
- TLSH
  T1D134F1107994E046C8520F704EBBD6F99964ADB46EF8D20F3390BB5C7FB13919A1A336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4