Severity
High
Analysis Summary
Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.
GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.
Impact
- Malware Installation
- Detection Evasion
- Information Theft
Indicators of Compromise
MD5
- 9c08c35097e3a60fb74ce55ca3bb7e89
- e141ee9d13be91e4b6af964e7628bbd2
- 714fe71ef892b5bf37bb5c9ca00f00c1
SHA-256
- 9732020b1cc8b1be48b587b7d60de7838ea6898dec58828c63a10852587aedd8
- c4fdc401afd09083d181b37d43cbf43b55171be9e98d946a0820e6c64b1bdbb9
- ecede113dbb76bc2f6707d303664ea0a48512a7d2c411b531a628a9317a6bda4
SHA-1
- 42937eebfa0c0ddbf55cab24b914c8c0b56d7470
- a5bd33918f41e2dd601d54373e0d691d82483824
- 3cc62f6c891d04acbf569b03c1f05725b040d1a8
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders.
- Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
- Enforced Access Management Policies