Loading malware…
GuLoader is a Windows shellcode-based downloader and loader that has been active since at least 2019 and is widely used in commodity malware delivery operations. It is commonly associated with the delivery of Agent Tesla, FormBook, NetWire, NanoCore, Parallax RAT, Remcos, LokiBot, XLoader, XWorm, VIPKeylogger, and Snake Keylogger/404 Keylogger. GuLoader is frequently wrapped in NSIS installers, VB-based launchers, or VBScript and PowerShell stages, and it is notable for decrypting and executing payloads directly in memory rather than writing final-stage malware to disk. Public cloud and other legitimate web services have repeatedly been abused to host encrypted GuLoader shellcode or downstream payloads.
The malware emphasizes defense evasion and anti-analysis. GuLoader dynamically resolves APIs through hashing, encrypts strings and payloads with XOR-based schemes, and heavily obfuscates control flow. A defining feature of newer variants is exception-driven execution flow using vectored exception handlers. Instead of ordinary branching, GuLoader deliberately triggers breakpoint, single-step, access-violation, and in later variants illegal-instruction and privileged-instruction exceptions, then computes the next execution address inside the handler. This design complicates static analysis, debugging, and signature generation. Additional anti-analysis behavior includes anti-debugging checks, hardware- and software-breakpoint detection, debugger hiding, timing checks, virtualization and sandbox detection, and inspection of system artifacts associated with analysis environments.
GuLoader also supports process injection. Observed variants create a legitimate Windows process in a suspended state and inject shellcode into it before resuming execution; RegAsm has been documented as one donor process. Later shellcode stages then perform network retrieval of encrypted payloads and execute them in memory. This architecture allows GuLoader to function as a flexible malware delivery platform rather than a final payload itself.
Distribution has been observed through phishing and spearphishing campaigns, including malicious Office documents with embedded macros, archive-based lures, NSIS-packaged executables, and job-, invoice-, tax-, shipping-, and order-themed social engineering. More recent activity has also tied GuLoader to web-based fake CAPTCHA and ClickFix-style chains that trick users into launching trusted Windows binaries to load remote content in memory. Financially motivated operators and intrusion clusters have used GuLoader in campaigns targeting businesses across multiple sectors, including banking and other enterprises, with notable reporting on activity affecting African financial institutions and Italian businesses.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cybercriminals exploited this vulnerability to deliver various malware families, including DarkMe and GuLoader, by crafting ZIP archives with spoofed extensions, which were then distributed on trading forums. | Group-IB Threat Intelligence unit discovered a zero-day vulnerability, CVE-2023-38831, in WinRAR, a popular compression tool. Cybercriminals exploited this vulnerability to deliver various malware families, including DarkMe and GuLoader, by crafting ZIP archives with spoofed extensions.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earlier this April, the Redmond-based company warned of several phishing campaigns leveraging tax-related themes to deploy malware such as Latrodectus, AHKBot, GuLoader, and BruteRatel C4 (BRc4). The phishing pages, it added, were delivered via RaccoonO365, with one such campaign attributed to an initial access broker called Storm-0249.
"...Visual Basic loaders —including the Guloader malware dropper discovered by Proofpoint on December 2019."
31 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack targets users who arrive at a legitimate-looking website through a Google search, with no phishing email or suspicious link involved... Malicious code hidden in the site’s WordPress backend quietly waits to activate under the right conditions.
The campaign chains a compromised WordPress site... Every layer is built to appear legitimate, giving most traditional defenses no reason to intervene.
When executed, it establishes a connection to an external file share, typically via WebDAV, to download an LNK or VBS file.
When executed, the LNK/VBS executes a BAT or CMD file that downloads a Python installer package and a series of Python scripts leading to malware installation.
The command calls rundll32.exe... pointing it to a remote DLL hosted by the attacker over a UNC path. The DLL loads directly into memory with no file written to disk.
The overlay tells the user to press Win+R, Ctrl+V, and Enter... the victim runs it willingly, believing it to be a routine check.
In some cases, the malware was named to trick the user into thinking it was a PDF file, e.g.: fiche de poste.exe ... fiche de candidature.pdf.exe
An attacker can edit that struct in order to manipulate execution on that address by setting the RIP (on x64) register, when resuming from that exception. | On Windows, as specified in MSDN documentation, it is possible to programmatically handle a specific exception by registering a VECTORED_EXCEPTION_HANDLER (VEH), which will manage the execution to handle that condition.
Examples include AppleSeed using HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce, AvosLocker executed via the RunOnce Registry key, NanoCore creating a RunOnce key, and the content listing HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce and RunOnceEx paths. | Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
The RegAsm process will be spawned in a suspend mode which indicates process hollowing injection... This instruction will write a second shellcode to the RegAsm process.
The DLL loads directly into memory with no file written to disk and no prompt shown.
The RegAsm process will be spawned in a suspend mode which indicates process hollowing injection... the first shellcode creates the RegAsm process and injects a second shellcode into it with a unique variation of the Process Hollowing injection.
Examples include AppleSeed using HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce, AvosLocker executed via the RunOnce Registry key, NanoCore creating a RunOnce key, and the content listing HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce and RunOnceEx paths. | Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
This section covers the obfuscation techniques that GuLoader leverages to hinder analysis and evade detection. Dynamic constant construction GuLoader employs polymorphic code to dynamically construct constants during execution.
Static Analysis will also take much time due to Control Flow Obfusucation... To Obfuscate the Control Flow it uses RtlAddVectoredExceptionHandler to register a vectored Exception Handler.
The polymorphic operations also impede static-based signatures that can be used for detection.
Similar to many malware families, GuLoader uses the DJB2 hashing algorithm to identify API functions, modules, and process names.
The RegAsm process will be spawned in a suspend mode which indicates process hollowing injection... This instruction will write a second shellcode to the RegAsm process.
The DLL loads directly into memory with no file written to disk and no prompt shown.
The RegAsm process will be spawned in a suspend mode which indicates process hollowing injection... the first shellcode creates the RegAsm process and injects a second shellcode into it with a unique variation of the Process Hollowing injection.
GuLoader hides its command-and-control (C2) domains, file paths, and other critical information by encrypting strings with a simple XOR algorithm.
The command calls rundll32.exe, a trusted signed Windows tool... Because rundll32.exe is a Microsoft-signed binary, it clears SmartScreen without any warning.
add 5 to it’s address to avoid any Hooking done by EDR .Adding 5 to the API address is to avoid the classic 5 Byte Hook.
This technique makes the malware's execution flow extremely difficult for automated analysis tools to trace.
Now, this register holds the API call EnumWindows ... After we step over the call to EnumWindows, we see the line: cmp eax,c. Using this line the shellcode determines if there are at least 12 ... windows in the machine. If not, the process will be terminated. | Next, we see the function 602038, if we step over it and we’ll see the string “ C:\Program Files\qqa\qqa.exe ”. This is because 602038 functionality is to search whether the Qemu gues agent is located on the machine. | Inside the function 601F28, there is another routine that consists of two anti-analysis mechanisms. Time cheks using RDTSC (Read Time-Stamp Counter), and anti-VM using CPUID. | The function will use the API call ZwQueryVirtualMemory ... scan the process’s memory... Each one of them will represent a string that is related to a Virtual Machine product ... If one of these strings will be found ... the process will create the previously mentioned message box.
Inside the function 601F28, there is another routine that consists of two anti-analysis mechanisms. Time cheks using RDTSC (Read Time-Stamp Counter), and anti-VM using CPUID.
An attacker can edit that struct in order to manipulate execution on that address by setting the RIP (on x64) register, when resuming from that exception. | On Windows, as specified in MSDN documentation, it is possible to programmatically handle a specific exception by registering a VECTORED_EXCEPTION_HANDLER (VEH), which will manage the execution to handle that condition.
This technique makes the malware's execution flow extremely difficult for automated analysis tools to trace.
Now, this register holds the API call EnumWindows ... After we step over the call to EnumWindows, we see the line: cmp eax,c. Using this line the shellcode determines if there are at least 12 ... windows in the machine. If not, the process will be terminated. | Next, we see the function 602038, if we step over it and we’ll see the string “ C:\Program Files\qqa\qqa.exe ”. This is because 602038 functionality is to search whether the Qemu gues agent is located on the machine. | Inside the function 601F28, there is another routine that consists of two anti-analysis mechanisms. Time cheks using RDTSC (Read Time-Stamp Counter), and anti-VM using CPUID. | The function will use the API call ZwQueryVirtualMemory ... scan the process’s memory... Each one of them will represent a string that is related to a Virtual Machine product ... If one of these strings will be found ... the process will create the previously mentioned message box.
Inside the function 601F28, there is another routine that consists of two anti-analysis mechanisms. Time cheks using RDTSC (Read Time-Stamp Counter), and anti-VM using CPUID.
60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A shellcode-based, memory-resident loader/downloader attributed via C2 infrastructure in this campaign. It is described as running entirely in memory and commonly used to drop infostealers such as Lumma and Vidar and remote access tools including Remcos and AgentTesla.
Mentioned as a malware family that uses the resource section to hide payloads.
Gremlin stealer uses the resource section to mirror the tactics of several high-profile malware families that frequently use this area for payload obfuscation, including: Agent Tesla, GuLoader, LokiBot, Quasar RAT.
GuLoader is referenced as malware that uses hardware breakpoints and vectored exception handling as an anti-analysis technique to manipulate execution flow without noisy memory patching.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.