✕
Request a Demo
Rewterz
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
March 30, 2022
Rewterz
Rewterz Threat Alert – Nanocore Rat – Active IOCs
March 30, 2022

Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

Severity

Medium

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also got its payloads from Microsoft OneDrive and websites that were controlled by an attacker. GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts.

Impact

  • Information Theft
  • Security Bypass

Indicators of Compromise

MD5

  • 3379cd709382c7406286dff2bf941477
  • 83377e8163869ee018e621c38ae6012b
  • 180bc2101b8274cdcb4efb07148d1f99
  • 42eebad134186872be5a285d38c1fc22

SHA-256

  • 4f7d9ae4dffd86b34f0f12432e5dcd7ac67257fadd589a149c2242c9c38d01c4
  • 2edb1b98f11438149127f9feb66adee897a520adb8cf186a7b5e56ee2d7fef0d
  • 8a807c70c2c8e86be31b30a0638416a4c0303c3838eca41cdea461896909f1a5
  • 459f575fc0749f2fa3ca0d49a17ff50339b97d9762782a0fead692389fe4869d

SHA-1

  • b7ace5977550d339f16e393ff6c10514191b57a5
  • f1415bb722f5cf7ee2d1dbbc16943f3f55afd95d
  • e452e2eab7f0cd86dc3068c2efc618ab92f5f145
  • 562cac13692b78f46eade73f7df8d3546b0ad879

Remediation

  • Search for IOCs in your environment.
  • Block all the threat indicators at your respective controls.