guloader | a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404

General

Target
Purchase Order2883.exe
Size 772KB
Sample240826-gdfd2axgra
SHA256 a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404
MD5 17eb8202cd25ebfb49eb1347ddbbe1d1
SHA1 cc59c2f0d3b4ad9cebdca36ede5182f6746cff87
SHA512 6338f1da11bc3e33a864aca2b349401cf190f5bca8a7b18a21ad1f3ab40f110ba9f32474a7e0d0a4813a5911b974c70d107d8f3acebcbf0759a21f32b486ebda
SSDEEP 12288:I1xZkxtCt777js4n4OdpvhVlp/+sH2WDAqQnm:I1xmCtLbBvpRH2WkqQm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Purchase Order2883.exe
- Size 772KB
- SHA256 a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404
- MD5 17eb8202cd25ebfb49eb1347ddbbe1d1
- SHA1 cc59c2f0d3b4ad9cebdca36ede5182f6746cff87
- SHA512 6338f1da11bc3e33a864aca2b349401cf190f5bca8a7b18a21ad1f3ab40f110ba9f32474a7e0d0a4813a5911b974c70d107d8f3acebcbf0759a21f32b486ebda
- SSDEEP 12288:I1xZkxtCt777js4n4OdpvhVlp/+sH2WDAqQnm:I1xmCtLbBvpRH2WkqQm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 90f3cebb5b3759eb1bd72cee7cd8b694440ee398fe970b763db7a7b67208e4c8
- MD5 8508fa0ab17e36e071687243283c2aef
- SHA1 d45391d0454fbb9eb66fa72ecf0e2cadf0522bfe
- SHA512 241cf26e57006402897d8adaff37f3006c1bdbb09d6c5d10c32d556996df5785dc81c35ccbbc74384f80853a3e4aea7be251a4fa2613be42108e11a00692df5a
- SSDEEP 192:S9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:SJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 608364aa628004d02d786e961b6fe3d04addeee7892d393871f71241cdf3137f
- MD5 3032c25dd603e66c040dce56f73de8d3
- SHA1 9393ba163219bf0913c1b6b13a42bad7ad69916c
- SHA512 08533c8b43f90210b47922ddfb7533e19ff1d85796705b2ff707e92315ae81cfc4b95428f1c26d34e742a57e183781bc12efafd2a50a97c02f14b3fd29fff851
- SSDEEP 96:rt4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:rt4Vlw1Iul5J8T1vK20I5VVGsb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6