Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

Severity

High

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.
GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.

Impact

• Malware Installation
• Detection Evasion
• Information Theft

Indicators of Compromise

MD5

• 902e2f729baf2525c301b79477ce7940
• aea282085671ab1cb79433ee8d770796
• 5e79724da6ab03cd2b672d6ae0c854df
• 7a73d970eb2c6ed82722d03092246a6e

SHA-256

• 1ce2398f687e2ee9d9803c23673307b0ea4b6fab18bf0447ef8eea49c819fea1
• 2fe4d1f29e01df5997628ee735911b7d5ba850e4a142aad09aaafa6372e61af3
• 242737bdc4a419f49bc39e5bf4f99e2c608ce71f9f8902d726726f7df5013560
• 4bd0a6383c28a6340f1f8070f4bb9d3cc27f3a7b1a7b1107c61ef6682bd6d96d

SHA-1

• 88fb2888a813521e659a670e4887c7f1baf528a5
• 9c38b6f6317a81f7a47328823cdb202d947b90e5
• 7b61f5f88efc75e5f1d38c566f9c4e6732bfd042
• c8536a0261b850456e9d9b54289f5e36e7014f21

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• Enforced Access Management Policies