March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
January 3, 2022
Rewterz Threat Alert – Mirai Botnet – Active IOCs
January 3, 2022
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
January 3, 2022
Rewterz Threat Alert – Mirai Botnet – Active IOCs
January 3, 2022
Severity
Medium
Analysis Summary
Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also got its payloads from Microsoft OneDrive and websites that were controlled by an attacker. GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts.
Impact
- Information Theft
- Security Bypass
Indicators of Compromise
MD5
- a6995d610d05f1befd4d55a11c8316a2
- 8205d65f76fa63e73b7685faf647a048
- ae871d1957030344d4cefc7295a1e964
- 81f377eda4163da1b74cae83e38ced9f
SHA-256
- 9a0f607996d23c505d63f1d79812e9cceff9175ef763055a6c67bdf599e5aa5e
- 16c6a61f609b7ef5cd13fc587805018efad3be42545912f4281adde004cf928b
- 6f8a836d10eada55bb1d3901ceb5b97711afc9f7018e3bd0f0a8e77521f18e5b
- a16d035ca37dbd7ab34c856f4cdf96a9898dcebba08c5801c99f3d3100ae6b3f
SHA-1
- af92a7717a7168c77623464b566c99eeba8aa7e1
- 79ea7b6dda9d45f021150d57ce90f340cef35940
- 73e0d642d14ca3dcfca3d22fa2312968d1ba5cd6
- e50abaf01a9fd3ae8176b5b6117f6b8f8a355ec0
Remediation
- Search for IOCs in your environment.
- Block all the threat indicators at your respective controls.
- Do not download files attached in untrusted emails.
- Do not download files from untrusted sources on the internet