• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – Autodesk Navisworks Freedom and Autodesk Navisworks Manage Vulnerabilities
April 6, 2022
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
April 6, 2022

Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

April 6, 2022

Severity

Medium

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also got its payloads from Microsoft OneDrive and websites that were controlled by an attacker. GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts.

Impact

  • Information Theft
  • Security Bypass

Indicators of Compromise

MD5

  • d4ff0a9964938e044304812adacfceab
  • e184b31478de1db5b3427a589bac2573
  • 21d9fd5a0644c27d57f9b39cec04d780
  • c5e59279d16c659897d63c7750b4e1fc
  • 6b9e17ba88b41e3b69f285e11578425a

SHA-256

  • d36c02ac32fab4990a899358293dd46fc737903d84929282520ea74db8bf46f1
  • 41689d4f0e8760219c0d3cbcc42b9ddcf4605a0ca468857825057007815e02b2
  • 0aab4343050be7f37c913fe5809888d026fc0843ef1b35b2ca4a719d9b201450
  • 95dc8071f2c25cf5373b17d935d2dd1658dcc381356ded3dd0caf8368d080db6
  • c59468ace2e43ed63f461ef2f41591db54cf4cfa227640131831ea73a1149198

SHA-1

  • 170773df3fa9eaa9559c76d0710586a8e56a6af8
  • 4187767f6a8f697ee879ad85a498dacce449a177
  • f0162cea5e4c1677c3837431b15e79889ea7b204
  • 5ccba87a3d575a71b02b0501141d28855021b857
  • 53568f381b6a98ce6df671a0e48c95b16d6bd8c3

Remediation

  • Search for IOCs in your environment.
  • Block all the threat indicators at your respective controls.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.