Loading malware…
GuLoader, also known as CloudEyE, is a shellcode-based downloader targeting Microsoft Windows that has been active since at least 2019. It retrieves, decrypts, and executes additional malware, including Remcos, NetWire, Agent Tesla, FormBook, and LokiBot. Payloads can be retrieved over HTTP and from legitimate cloud-hosting services, including Google Drive. Its primary role is payload delivery rather than the credential theft or remote-control functions implemented by the malware it installs.
GuLoader is distributed through phishing and malicious spam using purchase-order, payment, tax, and guest-enquiry lures. Delivery chains include malicious links, macro-enabled Office documents, documents exploiting CVE-2017-0199 or CVE-2017-11882, and cloud-hosted disk images containing malicious executables. It has also appeared in chains exploiting WinRAR vulnerability CVE-2023-38831. NSIS installers frequently package its components. Observed campaigns include attacks against hospitality staff, and TA558 has used GuLoader to deliver FormBook in its SteganoAmor campaign.
GuLoader employs extensive defense-evasion and anti-analysis mechanisms, including encrypted shellcode, junk instructions, convoluted jump chains, virtual-machine and sandbox checks, timing checks, and debugger detection. Variants use vectored exception handling to redirect execution through deliberately generated exceptions and inspect debug registers for hardware breakpoints. Execution techniques include injecting shellcode into suspended donor processes and invoking shellcode through Windows API callbacks. GuLoader can also establish registry-based persistence and delete its own executable to reduce forensic artifacts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The article links CVE-2017-0199 to Dridex distribution in 2017, Gamaredon APT operations, and GuLoader delivery. It also describes a document exploiting this vulnerability that had only one detection after six days.
The article identifies CVE-2017-11882 among three old Microsoft Office vulnerabilities still exploited in 2023. It explicitly links this vulnerability to GuLoader in 2021 and to Agent Tesla and FormBook delivery.
CVE-2023-38831 is a vulnerability that enables malicious actors to execute arbitrary code when a user tries to access a harmless file contained within a ZIP archive.
実行ファイルが使用されるケースでは、実行ファイル自体が情報窃取型マルウェア本体である場合と、実行ファイルがGuLoader(別名:CloudEyE)と呼ばれるダウンローダである場合があります。
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This targeting profile matches a campaign documented by Agoda Engineering as “BoredFluff”, which tracked GuLoader-to-Remcos infections targeting hotel staff through fake guest enquiries.
Guloader, to be used as the loader for fetching the next piece of malware, is then downloaded.
In this blog, we will dig deeper into the GuLoader malware which comes attached as a spam document in such emails. This malware is a VBdownloader...
In this blog, we will dig deeper into the GuLoader malware which comes attached as a spam document in such emails. This malware is a VBdownloader...
Initially identified (by researchers at CheckPoint) as Guloader, the new Visual Basic 6-based installer was tied to a publicly-marketed installation builder called CloudEyE.
In this blog, we will dig deeper into the GuLoader malware which comes attached as a spam document in such emails. This malware is a VBdownloader...
20 distinct techniques documented for this family, organized by ATT&CK tactic.
APT28 actors have exploited WinRAR vulnerability CVE-2023-38831 to drop a BAT file which opens a decoy PDF file and creates a reverse SSH shell to an attacker controlled IP address, and executes IRONJAW script using PowerShell.
“GULOADER executes shellcode through callbacks using different Windows API functions… We have observed EnumResourceTypesA and CallWindowProcW used by GULOADER.”
When a victim double-clicks on the PDF, the vulnerability will quietly launch a script in the folder to install malware on the device.
“By implementing the VEH, GULOADER flattens the control flow graph, making it harder to trace the program logic.” | “The encrypted shellcode is buried into a nested folder.”
331 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
141 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned among malware deployed in separate 2024 campaigns with a comparable attack chain. No role in delivering the analyzed Remcos payload is established.
Referenced as a loader observed using section mapping via NtMapViewOfSection with SEC_IMAGE for payload loading.
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
A shellcode-based, memory-resident loader/downloader attributed via C2 infrastructure in this campaign. It is described as running entirely in memory and commonly used to drop infostealers such as Lumma and Vidar and remote access tools including Remcos and AgentTesla.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.