guloader | 4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf

General

Target

4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf.vbs
Size

187KB
Sample

240628-bqeqdatamg
MD5

a408481803f47324f6479a3b70ad763b
SHA1

1a3232aeec010ce287ea65dd1a24255f95470d48
SHA256

4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf
SHA512

aab87aee34a0c93381fb0fb926edc137ffced40bba470b15dd45b798aeab9117f5a4daf30932dccef13c5c898d80f626e18a1a65d8c10b2c111319bb781f341e
SSDEEP

3072:dmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZg:d08GxbKja3+DCbKCvBB/WnHXC/sLJFJN

Score

10^/10

Malware Config

Targets

- Target
  
  4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf.vbs
- Size
  
  187KB
- MD5
  
  a408481803f47324f6479a3b70ad763b
- SHA1
  
  1a3232aeec010ce287ea65dd1a24255f95470d48
- SHA256
  
  4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf
- SHA512
  
  aab87aee34a0c93381fb0fb926edc137ffced40bba470b15dd45b798aeab9117f5a4daf30932dccef13c5c898d80f626e18a1a65d8c10b2c111319bb781f341e
- SSDEEP
  
  3072:dmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZg:d08GxbKja3+DCbKCvBB/WnHXC/sLJFJN
Score

10^/10

guloader collection downloader persistence
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Detects executables built or packed with MPress PE compressor
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Detects executables built or packed with MPress PE compressor

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook accounts

Adds Run key to start application

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2