Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

Severity

Medium

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.

GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.

Impact

• Malware Installation
• Detection Evasion
• Information Theft

Indicators of Compromise

MD5

• 4ce23c67160357c2102f8c5f6f669adf
• 9fb914c9a670ac3f2d7b43552c65ad10
• 044283cc5bee1d0cdc415a9155061d51

SHA-256

• 5f50b2bbd132ec4fcb465de520ce20c653579588069de9dc8f14579ebe2d062c
• 412f983cf1fb087d9b21bed966aaf91b7468ed1c9f792fb32e5b0a6e9dbbf0c1
• 423efe05f8bcafa36531cb05aadd42fa0ac6a171de0fa5b9749755c7c3a13af7

SHA-1

• f3f8eff2149c3a7fa540113133c61b6065968058
• 29139cf19cdb8a58e23be3d1b55558e323e51a23
• cb4a7579f065201c2a14c36a5dacd9adb1c775fd

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• Enforced Access Management Policies