Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs

Severity

Medium

Analysis Summary

Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.

GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.

Guloader is often distributed as part of a wider malware campaign and is usually delivered in a packed or encrypted form to evade detection by security software. Once it has successfully installed itself on a system, it will attempt to establish persistence by modifying system settings, creating registry entries, and adding itself to startup items.

GuLoader has been actively deployed for over three years, and its developers continue to enhance its capabilities. The latest version incorporates advanced anti-analysis techniques, making it extremely challenging for security researchers to analyze and detect. In fact, the most recent GuLoader samples consistently receive zero detections on popular antivirus platforms like VirusTotal, ensuring the stealthy execution of its malicious payloads.

One notable feature of GuLoader is its fully encrypted payload, which includes the PE headers. This enables threat actors to store the payloads on well-known public cloud services, effectively evading traditional antivirus protections. By leveraging cloud storage, the malicious payloads can remain available for download over an extended period without raising suspicion.

While earlier versions of GuLoader were implemented as Visual Basic 6 (VB6) applications containing encrypted shellcode, the current variants predominantly utilize VBScript and NSIS installer-based techniques. The VBScript variant, in particular, stores the shellcode on a remote server, further complicating detection and analysis.

To protect against Guloader malware, it is important to have a strong antivirus solution in place and to keep all software up to date with the latest security patches. Additionally, users should be cautious when opening email attachments or clicking on links from unknown or suspicious sources.

Impact

• Malware Installation
• Detection Evasion
• Information Theft

Indicators of Compromise

MD5

• 257297a671a67c3153fd9fe32ee5406e
• b584af26682595c6bc00bfa48cf1fe66
• 41518baa70e3ef0a44e6815913b89c86
• 67b6e194c99a760919ec42c42bc87de0
• ef3f7343f6881f1f6f2462529be898e9
• f7770284f700d474444e374273949c9d

SHA-256

• 0725b0e4da8887a3285b0af626673e8d406c5badb9a1b8024563540dddd16ed4
• 6ef8c4ab3a5a7c626a151ff95aa444789f29b87db1dec656377e50723651b183
• d70420ee594c359a3c438310e98730a185fe7032bbffb3e0f28294218d1297ea
• f7d5f219270af7750ec88e6bc13add921895d7bca13c58f596cfe86946ffae61
• 9f276f8da95a8bfc18d4640880f8815734bb150b1a75f030be587ca863c19a74
• 4941ad790a9a53a5c8ea43ef512ee9d56dd7dc797904c7a4fe6dad9d7a36adb1

SHA-1

• ff95223434a62fa753334f32e10ac29f8269301c
• 821859be5c7992928da5e4846313e8248accb10b
• 2581d5c6767ea0d458657d13e466383e883ab464
• ad87c31f3a75ff1c3d9ac8c85a557d9f29a89b75
• 8d6cc5b35521b370b85409e2c4f36af44c264f04
• c8e244649210caebf68b237a98d4f1b097c6e59a

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• Enforced Access Management Policies