Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

Severity

Medium

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.

GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.

Impact

• Malware Installation
• Detection Evasion
• Information Theft

Indicators of Compromise

MD5

• 4b8c8ae428cb1c525b2484b1c3c51999
• acddfddaae945fbdd5a4a6ab46bb8279
• 7925ddca80b756e05d485c89c7ee6609
• 9a8b680656ea0ae99618fe0b81b3ffea
• ab4df9c4ba85a7a1a894eae647e9c674

SHA-256

• 158c27f1e1f7c9b24f475ac99bb80e6409a1859340ffa3f322b818ac9b724cf6
• 11ec59882425698a5ac232e9b1fbc40d8abca974a1a836ccbf2dc4c9bf35ce21
• faad28929ab211e13525bae7fbe78a6805b2aa90b70e870caaea6fd6c90671dd
• 845f78d8dc0abc6f0fc4e2a59ff956a8df46187ea12095c68696e5f765fb7344
• c4da13c88b28a19f692821703265c4c30831b5d598c326bfd1e33932fa5bd78a

SHA-1

• 8c7102bc351bf0652d070a7da89f70aa3fb4e987
• 733a00285a9e3aef79b8899f93afa3b127d348de
• de226ed5b3f146bc09ec5c59eee7d7b81a83eea6
• 2ee5d86c62e764e95c9a0e2e1cc4b869b91013f7
• dfe2d4a7867da5e64fdbaeee490db31fd0eccd8d

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• Enforced Access Management Policies