Edit tour

Windows Analysis Report
SC.028UCCP.exe

Overview

GuLoader

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Tries to detect virtualization through RDTSC time measurements

Uses 32bit PE files

Drops PE files

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

PE / OLE file has an invalid certificate

Contains functionality to dynamically determine API calls

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

SC.028UCCP.exe (PID: 5928 cmdline: C:\Users\user\Desktop\SC.028UCCP.exe MD5: 3F8F4A7F43B5627ED45128BB99F0B471)

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/ https://blog.morphisec.com/guloader-the-rat-downloader https://blog.vincss.net/2020/05/re014-guloader-antivm-techniques.html https://cert-agid.gov.it/news/malware/tecniche-per-semplificare-lanalisi-del-malware-guloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Unepitomizeds\Indlaansrenter\Patter.Lam	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security

Source	Rule	Description	Author
00000000.00000002.782049027.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000000.00000002.782394015.0000000002B00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000000.00000002.782394015.000000000400D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Click to jump to signature section

Show All Signature Results

AV Detection

Source: SC.028UCCP.exe

ReversingLabs: Detection: 33%

Source: SC.028UCCP.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SC.028UCCP.exe	Code function: 0_2_00405475 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405475
Source: C:\Users\user\Desktop\SC.028UCCP.exe	Code function: 0_2_00405E9C FindFirstFileA,FindClose,	0_2_00405E9C
Source: C:\Users\user\Desktop\SC.028UCCP.exe	Code function: 0_2_0040264F FindFirstFileA,	0_2_0040264F

Source: SC.028UCCP.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SC.028UCCP.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SC.028UCCP.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: SC.028UCCP.exe	String found in binary or memory: http://s.symcd.com06
Source: SC.028UCCP.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SC.028UCCP.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SC.028UCCP.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: SC.028UCCP.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: SC.028UCCP.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: SC.028UCCP.exe	String found in binary or memory: https://d.symcb.com/rpa0.