General
- Target jaffacakes118_11019206463_eml_quotation.zip
- Size 5.3MB
- Sample260917-wtak2shd35
- SHA256 3a30b483822bfc64e9874f2a846e8233b19a8eedb0258f55ff51a67c9e8ee055
Score
10/10
Malware Config
Targets
-
- Target Bid Acknowledgement 94573.docx
- Size 33KB
- SHA256 7af46e0bfac71c5acf1597d6e3a230cf42af7c5200e3dceec2287d315646a9c9
Score1/10 -
- Target COMMERCIAL CONDITIONS AND INSTRUCTIONS TECNICAS REUNIDAS.pdf
- Size 369KB
- SHA256 a33042256eb3ec0a6e01cd19ec88eb7666a31aa5e36569e7653da0bbd2cc69a4
Score3/10 -
- Target L-GT-005-F_2 (Terms Cond Transportation).pdf
- Size 5.0MB
- SHA256 91b73e305c59352b3526afbdf56f18cc977d7d9fad35750e0f8d4a96302d866a
Score3/10 -
- Target RFQ-945730101-B0000005023019.exe
- Size 372KB
- SHA256 0ab6668c4bc57f654f1b09af524dd2313ecf7900f347e0c0b2d5b9f8e07eb6d6
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
Score3/10 -
- Target Dyrepark/Hypothesist/System.Diagnostics.TraceSource.dll
- Size 130KB
- SHA256 1268992f73b4cababad60132ffd0e5b263be1fcefa3424682122ea30c782215a
Score1/10