

Multiple Zyxel CPE Series Vulnerabilities
January 31, 2025
CoinMiner Malware – Active IOCs
January 31, 2025
Multiple Zyxel CPE Series Vulnerabilities
January 31, 2025
CoinMiner Malware – Active IOCs
January 31, 2025Severity
Medium
Analysis Summary
Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.
GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren't often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations' apps, including browsers, FTP clients, and file downloaders.
Guloader is often distributed as part of a wider malware campaign and is usually delivered in a packed or encrypted form to evade detection by security software. Once it has successfully installed itself on a system, it will attempt to establish persistence by modifying system settings, creating registry entries, and adding itself to startup items.
GuLoader has been actively deployed for over three years, and its developers continue to enhance its capabilities. The latest version incorporates advanced anti-analysis techniques, making it extremely challenging for security researchers to analyze and detect. The most recent GuLoader samples consistently receive zero detections on popular antivirus platforms like VirusTotal, ensuring the stealthy execution of its malicious payloads.
One notable feature of GuLoader is its fully encrypted payload, which includes the PE headers. This enables threat actors to store the payloads on well-known public cloud services, effectively evading traditional antivirus protections. By leveraging cloud storage, the malicious payloads can remain available for download over an extended period without raising suspicion.
While earlier versions of GuLoader were implemented as Visual Basic 6 (VB6) applications containing encrypted shellcode, the current variants predominantly utilize VBScript and NSIS installer-based techniques. The VBScript variant, in particular, stores the shellcode on a remote server, further complicating detection and analysis.
To protect against Guloader malware, it is important to have a strong antivirus solution in place and to keep all software up to date with the latest security patches. Additionally, users should be cautious when opening email attachments or clicking on links from unknown or suspicious sources.
Impact
- Malware Installation
- Detection Evasion
- Information Theft
Indicators of Compromise
MD5
1005d21545b5edc314394253cf25b1e6
02c65afc817f61d1d182e170a44d4843
6ca301ca8387dce5fd21f318ebba05c6
SHA-256
fa79537e463c6a9b8c2e1ad111194e97045caa67e8c7d59cd0789582dc27691e
98d06e4d2c0ca3e9d257f28269a4a1040c1fa51ddbb6214e8d2b6eed2ab8aadf
f6ad2374fe19582a54ac0b9972ec41223f4291af9e49834fbd240629b9c74e62
SHA1
6b82a47d70c262d2fb23c55c5948f94d2165ac55
01ae56d0d7be193e9645a18e466038ae186bf944
42721db007b2a33119e951aa29749af25bc4cf01
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Emails from unknown senders should always be treated with caution.
- Never trust or open links and attachments received from unknown sources/senders.
- Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
- Enforce access management policies.