guloader | ac62abef9ea5485a775de19ae39d47d624ebdeea4727690cf9637b9348986c25

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 04:22

Target

ac62abef9ea5485a775de19ae39d47d624ebdeea4727690cf9637b9348986c25.exe
Size

97KB
MD5

ba455844112f8c74e270b878235c60bd
SHA1

635adfb20ba50cc3eee0e5571020019f45ca2f3f
SHA256

ac62abef9ea5485a775de19ae39d47d624ebdeea4727690cf9637b9348986c25
SHA512

7f3392d6ff373dda8925135f9d4ed5b95290fafe2bcf32bfe0fad620f79e4a4047d0dd8598d072f7428f208f6279c41a08f762f88efa59551c0f494e49b059a6
SSDEEP

1536:Z2euZu4vhLo8gE961bsy+wHVVQ5C6eUwoJXxLCH:7nKo8+bnYwoJIH

Score

10^/10

Family

guloader

https://dailyhintnews.com.ng/vbb/janomo_sdxmJQ124.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Guloader payload 1 IoCs
guloader

Processes:

resource yara_rule

behavioral1/memory/2180-2-0x0000000000350000-0x000000000035B000-memory.dmp family_guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ac62abef9ea5485a775de19ae39d47d624ebdeea4727690cf9637b9348986c25.exe

pid process

2180 ac62abef9ea5485a775de19ae39d47d624ebdeea4727690cf9637b9348986c25.exe

resource	yara_rule
behavioral1/memory/2180-2-0x0000000000350000-0x000000000035B000-memory.dmp	family_guloader

pid	process
2180	ac62abef9ea5485a775de19ae39d47d624ebdeea4727690cf9637b9348986c25.exe

C:\Users\Admin\AppData\Local\Temp\ac62abef9ea5485a775de19ae39d47d624ebdeea4727690cf9637b9348986c25.exe
"C:\Users\Admin\AppData\Local\Temp\ac62abef9ea5485a775de19ae39d47d624ebdeea4727690cf9637b9348986c25.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2180

memory/2180-2-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/2180-3-0x00000000774D1000-0x00000000775D2000-memory.dmp

Filesize
1.0MB

Download