guloader | jaffacakes118_Trojan-PSW[.]Win32[.]Fareit[.]eblj[.]2c2ab06be7e1a7756c97c749740526b4

General

Target
jaffacakes118_Trojan-PSW.Win32.Fareit.eblj.2c2ab06be7e1a7756c97c749740526b4
Size 628KB
Sample261010-pt8dravvdx
SHA256 6643a9d8f5790c320094d5b1cbc92d2f41947dcac1f2e7affbc91e0c59281af3
MD5 2c2ab06be7e1a7756c97c749740526b4
SHA1 94188474515bfef8fb1fba14fd576ed73772ed81
SHA512 60700884dd5fe2a2bf1fc912739c9fcc694ec91cedb7cd090a5ab7a2196071b26d0195af238a87018bc996ad60219915df8000dfc51f859f2f41caacef95d1bb
SSDEEP 12288:5H65HqO7EW+/amXnMIW/Ti3xRT3U4JYDYZB:sAL/am8V/u/T3UiYDY
TLSH
T1B7D4F1D7F566E5AFC85383FD1A0E9D561E92FDB48245E80A2F61025F406B6E38C4E80F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-PSW.Win32.Fareit.eblj.2c2ab06be7e1a7756c97c749740526b4

jaffacakes118_Trojan-PSW.Win32.Fareit.eblj.2c2ab06be7e1a7756c97c749740526b4

.exe 628KB

IMPHASH 102138831c24ff01eb62f9cf58333508
SHA256 6643a9d8f5790c320094d5b1cbc92d2f41947dcac1f2e7affbc91e0c59281af3
MD5 2c2ab06be7e1a7756c97c749740526b4
SHA1 94188474515bfef8fb1fba14fd576ed73772ed81
SHA512 60700884dd5fe2a2bf1fc912739c9fcc694ec91cedb7cd090a5ab7a2196071b26d0195af238a87018bc996ad60219915df8000dfc51f859f2f41caacef95d1bb
SSDEEP 12288:5H65HqO7EW+/amXnMIW/Ti3xRT3U4JYDYZB:sAL/am8V/u/T3UiYDY
TLSH
T1B7D4F1D7F566E5AFC85383FD1A0E9D561E92FDB48245E80A2F61025F406B6E38C4E80F
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths