✕
Request a Demo
Rewterz
Rewterz Threat Alert – APT-28 FancyBear – Active IOCs
January 27, 2022
Rewterz
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
January 27, 2022

Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

Severity

Medium

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also got its payloads from Microsoft OneDrive and websites that were controlled by an attacker. GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts.

Impact

  • Information Theft
  • Security Bypass

Indicators of Compromise

MD5

  • 0dcb37ff90b93b7a3225707b1af111b8
  • 6ea8ecf670ed24734a3be72b69bc5fd9
  • 82c5cdde9df0a76e2933c1cd8bfc7887

SHA-256

  • 4468c48f99c92e56bb04921a42676511c64b39f9ae99fcd08f2a10251618baf2
  • 7667e9078741e3ad3b07f45a2311b4c03a283cf4a060db8341b91999fd0e8709
  • 243ae30d42e90000b882779fae40e0056eab332b95e2c938446138a80868909e

SHA-1

  • e43402bd22a03687fc4fbe36cbb607ecc7bc1a0f
  • bceaef2755d79ab3dacbbf98b42d28bd307dc177
  • 7b391b4429dfbf19030fb49ce750aa3c8b844a6b

Remediation

  • Search for IOCs in your environment.
  • Block all the threat indicators at your respective controls.
  • Do not download files attached in untrusted emails.
  • Do not download files from untrusted sources on the internet