guloader | bbe5a6dad072ccb10608f30a3c699b211ae6683b368acb49fc48100991ec7683

Sharing

Copy URL Twitter E-mail

General

Target
213497664-030339-sanlccjavap0003-1.pdf.rar
Size 219KB
Sample261011-ancybsbz6q
SHA256 bbe5a6dad072ccb10608f30a3c699b211ae6683b368acb49fc48100991ec7683
MD5 95d9c079993486d300a188a17904d86a
SHA1 0e1264c1b4332a3903f7cfe5e6357fe95bd74808
SHA512 2fbce01aea7f9c1d491ae5b549e8ed7d29102ed2df265060597c3ebaa9170f11c7b1274c08669d2d3d1a073c9b0d1361ce46ab846e3076afd2b2243598677271
SSDEEP 6144:1nrn/fdyRKTFqUPWTLQDGsSbX+L4B01m6wtPQvZn4:xj/kR4FPPeLQab+I01qkn4
TLSH
T1172423FCE1E51672B32159D926A0B5113D200AB646B8BFC953F35099DA20ED3E1CB06F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  213497664-030339-sanlccjavap0003-1.pdf
- Size 242KB
- SHA256 74f92fb6e52a3be7d44f8698501a2c8f8e93ba79ab30421ca54991482c569a96
- MD5 fca05b942571bced64183390118566e8
- SHA1 46994e48d38d4cef9b08d16b0ad9667c78e38f5c
- SHA512 65451509ec14651b4a51fc38a21a944b655723d0671fd7b1471f7173bdef276d4b3162dddeeb9492a82eaa08a9751644f6e34190eed34b3dd2467d31249159c6
- SSDEEP 6144:GBd9vLY8tOHOtzKnKvDKm/vJiuunIax914YsQ6R/S:6fY6OHOEnKn3JinIaH142e6
- TLSH
  T1DC341211E665E182DAB096346832A6B66DF5FE19D5A3AF5603F02F4D3C138C2CE1E234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery downloader guloader privilege_escalation
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- MD5 17ed1c86bd67e78ade4712be48a7d2bd
- SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
- TLSH
  T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Tubelike/Linieforbindelsen/basted/inode-directory-symbolic.svg
- Size 838B
- SHA256 ec055cbe2ecfe7169d86da733cb5f38c91c7446065c55843abb4e4135477e639
- MD5 3f291c9b3235c054e6a3a118d8bf8878
- SHA1 257ae4a197d8c5fec17060b257e0ee22ccb79712
- SHA512 e89ade2e6f767d0fdbf4fe58f5908a23e6b915c41aace57998389a4d179011e982d1afa746f75be97e8b2126416189552dd948d12fae3b0b7e4cfe871994184b
- TLSH
  T1BD01CCA4D1A46CC580C6C671E36EA914D034A0DB4E7E4D6BE68E062869C34B77387768
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  Tubelike/Linieforbindelsen/basted/system-software-install-symbolic.svg
- Size 932B
- SHA256 99a153d614b578b7df327f25ebb900c3e259e2d871d48786fa4b4ccda3f18eed
- MD5 b67f347471c5271e73789fc1acb43a52
- SHA1 f909bd30fc604bfa23a4fdc61f924ebcbda13157
- SHA512 c5624a86518dcd0362ca5f25cbc1ea074f9186dfb96cb027b93275f7785f1e7447ac403bcfb5c376ca18d1ee70f3109399f7e727d27b957e5b6f0967682f513b
- TLSH
  T1EE11E1A0D16918CC50AACD2DE36F9910C024D0C39EBB4816EE0E152481CBAF6F306768
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  application-rss+xml-symbolic.svg
- Size 1KB
- SHA256 dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f
- MD5 5343c1a8b203c162a3bf3870d9f50fd4
- SHA1 04b5b886c20d88b57eea6d8ff882624a4ac1e51d
- SHA512 e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949
- TLSH
  T17B21422992983814F69384A061F277C23F078286E66F1B68A023B263E4C26E281D33C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  application-x-executable-symbolic.svg
- Size 2KB
- SHA256 f96ebd3b6575ccab1cf25ae741bc97c34dad770765aa48bd6bc85fade5630aad
- MD5 4bef718a161052724388b87586151ef1
- SHA1 44e68ed0dad33758da1a6c16520249ebf9d63d9d
- SHA512 03bb2fbd9667df06c84ac935b9838a425da47eadc602a36d4d356c26f3a3dda04e223d967f929238c93cfc285c98bade8b1de07feb84f1274d166241313d4da6
- TLSH
  T14F4133D6403057C8A081CA6AFFFBED54902950EB69BA84C2CB9F471491CB8D5F701B94
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  emblem-ok-symbolic.svg
- Size 284B
- SHA256 58dc62b5f1302b16ff7e918135ff3fee36ecf42ad852677cd315f076655fd74f
- MD5 d0fcf0edd746308af9d10cbc5719107b
- SHA1 d75720b35ebb2bf4c3f33343eb67bf30d2683195
- SHA512 bb167b22f7b7edfbc90fd60385e983e017a0c12cfce05c31b8da8413a6b566d0c772911028896d511d68e6896091d622fd045bb071d38bfdf99a3f49e24e5658
- TLSH
  T135D0E7703640873D51D00A3025F4C40251A8F05541407017F48431510C2DDD58F946DF
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14