guloader | bfae3fe9b5fa79f729d2eeeaf21bb0d8d5b1080c3cc08c8d36a4d90f27a26064

General

Target
StySwift003-D4900-D03PP-W20000P-K84902-E38992.exe
Size 606KB
Sample251209-e43adatndx
SHA256 bfae3fe9b5fa79f729d2eeeaf21bb0d8d5b1080c3cc08c8d36a4d90f27a26064
MD5 423e12710b0977ba43e01a50e1bff21e
SHA1 0ae217eb7a76dd7980090465faacdab89afd0d66
SHA512 fc62fc73196e569849bd6ad579e53ad4ca51294df89a191379ba609116d262429c10e26d1ece9fdc25f28ab78d736d9b0b017c74755316a7976bffac396bdf5b
SSDEEP 12288:oX6edX7wEDVllcHphQmw2ULxw413MRkBQ:oKedXMeSJSmw/Ly413MRP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  StySwift003-D4900-D03PP-W20000P-K84902-E38992.exe
- Size 606KB
- SHA256 bfae3fe9b5fa79f729d2eeeaf21bb0d8d5b1080c3cc08c8d36a4d90f27a26064
- MD5 423e12710b0977ba43e01a50e1bff21e
- SHA1 0ae217eb7a76dd7980090465faacdab89afd0d66
- SHA512 fc62fc73196e569849bd6ad579e53ad4ca51294df89a191379ba609116d262429c10e26d1ece9fdc25f28ab78d736d9b0b017c74755316a7976bffac396bdf5b
- SSDEEP 12288:oX6edX7wEDVllcHphQmw2ULxw413MRkBQ:oKedXMeSJSmw/Ly413MRP
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery downloader guloader persistence
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6