guloader | 60188919c159101b0835f101518b5af3824f676104975af9d220fa5249fa1f51

General

Target
jaffacakes118_Trojan-PSW.Win32.Heye.gaj.13ccf6da45d6944f60e123de1043e85f
Size 885KB
Sample261010-p375cahd46
SHA256 60188919c159101b0835f101518b5af3824f676104975af9d220fa5249fa1f51
MD5 13ccf6da45d6944f60e123de1043e85f
SHA1 1b2ad1672a73d534a71613272ec138a9a77e4046
SHA512 e739bea53e9b2feb23069e10e0a9f8c1987a34dcb85b6b89af744a9a10835e876991c5554584e800263c6b98a52aadcbc600975317e30067f453f0314e1fb12a
SSDEEP 24576:BNiNwQMhr/ascZNLFPS1FatRglcrBhMt1:BgnMVisWziFuGcNQ1
TLSH
T19C15E00714340090EDF8D975AB7AEA4BAF18FEA5E9D8F709460EF376B836AB404315D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jaffacakes118_Trojan-PSW.Win32.Heye.gaj.13ccf6da45d6944f60e123de1043e85f
- Size 885KB
- SHA256 60188919c159101b0835f101518b5af3824f676104975af9d220fa5249fa1f51
- MD5 13ccf6da45d6944f60e123de1043e85f
- SHA1 1b2ad1672a73d534a71613272ec138a9a77e4046
- SHA512 e739bea53e9b2feb23069e10e0a9f8c1987a34dcb85b6b89af744a9a10835e876991c5554584e800263c6b98a52aadcbc600975317e30067f453f0314e1fb12a
- SSDEEP 24576:BNiNwQMhr/ascZNLFPS1FatRglcrBhMt1:BgnMVisWziFuGcNQ1
- TLSH
  T19C15E00714340090EDF8D975AB7AEA4BAF18FEA5E9D8F709460EF376B836AB404315D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery downloader guloader hawkeye keylogger persistence spyware stealer trojan
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Family: HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2