Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

Severity

Medium

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.

GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.

Guloader is often distributed as part of a wider malware campaign and is usually delivered in a packed or encrypted form to evade detection by security software. Once it has successfully installed itself on a system, it will attempt to establish persistence by modifying system settings, creating registry entries, and adding itself to startup items.

To protect against Guloader malware, it is important to have a strong antivirus solution in place and to keep all software up to date with the latest security patches. Additionally, users should be cautious when opening email attachments or clicking on links from unknown or suspicious sources.

Impact

• Malware Installation
• Detection Evasion
• Information Theft

Indicators of Compromise

MD5

• c6db01a5743d408fc4f0c37ba58a281f
• 43a6a66fb89e618f4e47a02af4d8da2f
• 406b3d0752bdde1706509e02f449dc1d
• c11f0e0fec2f0b3540b79b30986f42a6

SHA-256

• 55130719554a0b3dcbf971c646e6e668b663b796f4be09816d405cc15a16d7d6
• 07079c49949ed4619204d3b640c590e102156526e9796c4966ead639b992385d
• 7d6e9247de0527fa4c0939c4f6e6726a35cb5f39492a7aeab5614ac1ab29b294
• 27067fb67db005cb58c65f2c9f66837211c9f98d2727c9dda27942397fdcd52b

SHA-1

• 992d98aa6f31ae6f8f42fac9866a19c2a2f879be
• b8b546cd42d34141646ad983b9880abaa48891c6
• a88933d9f0cff0102f089615c9580bcc10a1e405
• 06621d1a2829b0ce2c6ae1c42bf5139ae7c541b6

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets