Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

Severity

Medium

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.

GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.

Guloader is often distributed as part of a wider malware campaign and is usually delivered in a packed or encrypted form to evade detection by security software. Once it has successfully installed itself on a system, it will attempt to establish persistence by modifying system settings, creating registry entries, and adding itself to startup items.

GuLoader has been actively deployed for over three years, and its developers continue to enhance its capabilities. The latest version incorporates advanced anti-analysis techniques, making it extremely challenging for security researchers to analyze and detect. In fact, the most recent GuLoader samples consistently receive zero detections on popular antivirus platforms like VirusTotal, ensuring the stealthy execution of its malicious payloads.

One notable feature of GuLoader is its fully encrypted payload, which includes the PE headers. This enables threat actors to store the payloads on well-known public cloud services, effectively evading traditional antivirus protections. By leveraging cloud storage, the malicious payloads can remain available for download over an extended period without raising suspicion.

While earlier versions of GuLoader were implemented as Visual Basic 6 (VB6) applications containing encrypted shellcode, the current variants predominantly utilize VBScript and NSIS installer-based techniques. The VBScript variant, in particular, stores the shellcode on a remote server, further complicating detection and analysis.

To protect against Guloader malware, it is important to have a strong antivirus solution in place and to keep all software up to date with the latest security patches. Additionally, users should be cautious when opening email attachments or clicking on links from unknown or suspicious sources.

Impact

• Malware Installation
• Detection Evasion
• Information Theft

Indicators of Compromise

MD5

• ddd61ade0077dd9f737b8edcc079f631
• 4fe00a2df62b1a34a6c6a674da23a11d
• 1f48088d23310d1217509d1b962f3450
• b785a28741ac8545c2be658140f6145c
• 7b039d47de748555460ddd62fad6cc12
• eb680cc2d4c3a96208275e2c118bb171
• 5fdfd66abc4117ff9f97bce487cf4f7d

SHA-256

• 57459d0aae202432d60aba3e1d83b2bc0ea3e4bf2152ab8f32b2d1c66d2265dc
• 02156540b013d64be818a91df2aacca85b28861c5ff79a8f4b212a0c3f82592a
• 6f9574f0ec27d13a966f09787ceace0505ba20791b3327531a55374f33d319f3
• 1a2d7db620b0e3ef2962b9775bae92fc161206f27dd416c6f7c69fa93c799512
• c14f03d40463a937c43d9e7717acc6c96c5b294c0d15a6431d09b5e3e2a76d45
• dfd5b2aab7a193106294e5f560989a3bc35f37341ec6132b21da4c01abbc5b89
• 8bce65195a07ca72693f21081aa1d86deb2fdd5784d0e666c0833a9f9bdaf78d

SHA-1

• 1cc3920f83f8653d5f3d1fa8af649fc9699669e7
• e5fad10f3553622396cf0e37af55c511f9481634
• 185ab0c5a2da8b901ad5a344b2931858ee662e95
• f428fdee60496b5324eed378fba15c2510185137
• 24d5d05fda9ceb49462fc4a0a03e7b8e97a1f9e5
• 4db0c7ce1c7b62b03539fa308ad7a64b69a9872b
• 24b9df693585b218a447130ec3f385b9225af6d2

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.