guloader | 743856a6de710da4e6abf3393c730710fdbb41028ffd943cbbd13720ad536220

General

Target
jaffacakes118_11278016967_gu_russian_campaign.zip
Size 283KB
Sample260917-wtcqeahd48
SHA256 743856a6de710da4e6abf3393c730710fdbb41028ffd943cbbd13720ad536220
MD5 ce3bfc87255f9aec72f0021c458d733e
SHA1 73e48072b4a8d80bc4e5c25bc0841836692649a3
SHA512 dd507fecb8ceb97b5df1ce1d8916005540c5462295e59e5ccf60ab8de9473bcce4f1e682c460a44458a098acdf8fffd0b4bf24343d87036c0fc7bb9b768388b5
SSDEEP 6144:Q3WoSV5u1TgplX8GY/LrNx2AvKp2qMnV6frZsIaCjQ2nvUCiva+EHE:ESyBACqAv6MVo7QexivfF
TLSH
T11654231AE2CBE510FBA9A3A5D0640D7A9E223941DCB969E353F72D80E420F543FB4375
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63
- Size 364KB
- SHA256 818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63
- MD5 b568fdf2d302aa60e1bdd3ee24403145
- SHA1 20be73507e51bf3fe2de3082b28ac23fbb369dd1
- SHA512 3674ab3fc2d5e75b3f849405d323537d276b71139aaf5207a50e4da53d3dd965a80f33b1d1402a5bcbb9dfd91554c6a54ced69a13420e22314f81fe752367748
- SSDEEP 6144:4iucV6ntDwxp9x6EmioEmGX7TcUyixOKgMxMXiXr2XLBD85Py7Wfmld7a2g70qh7:4iuXtDKp9x6EmiUGX7TcUZHgMvWJL7Wr
- TLSH
  T16684D091F2C898E6F44343B14C36EA61112FBE5D5137491A3E2B7A39B9732436326DCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 852047023ba0cae91c7a43365878613cfb4e64e36ff98c460e113d5088d68ef5
- MD5 be2621a78a13a56cf09e00dd98488360
- SHA1 75f0539dc6af200a07cdb056cddddec595c6cfd2
- SHA512 b80cf1f678e6885276b9a1bfd9227374b2eb9e38bb20446d52ebe2c3dba89764aa50cb4d49df51a974478f3364b5dbcbc5b4a16dc8f1123b40c89c01725be3d1
- SSDEEP 192:eB2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsE+:3S62Gw947ExuGDI7J8EF7KIE
- TLSH
  T16A326B26535480F2F0A09079885B372B3B3A560166BA4ED7CFE7C5867E282E67D3C713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  AsProcessHelper.dll
- Size 25KB
- SHA256 173096b559f6f0cc183578eede448aeb75b37fc34cc6988814d9f285a546f4aa
- MD5 fc9ee63d7c846fbea1a615068f26a922
- SHA1 737e75533e51a45d80c41230a599e2a413ec5153
- SHA512 b71eb0cdc6489216fa04be5efdd14588315f9f6992c5943806d76115a6fb383d063c6175bd8b654c512c6437fe2b678f545daed90f401049d6c2af1e9588cf4a
- SSDEEP 384:2Dm8uyVmJ9VSsSyVFLvjzf0rPmbz0V8FqtvAse5PHi9tRuFCc/ZsHLOtiahqvW:2HmJ21orBQFAd5KnRnccOMahX
- TLSH
  T140C22B5AB7E90C56E436C931A4B28F1AEA32F1625F21C79F5724420D4F723807D3DB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6