GuLoader

eSentire has observed a substantial increase in malware being delivered through tax-themed phishing emails. Cybercriminals are exploiting the urgency and importance of tax-related communications to trick individuals into opening malicious email links, leading to malware infections.

GuLoader malware which comes attached as a spam document in such emails.

These emails often appear to be sent from legitimate tax authorities or financial institutions and include malicious links leading to malware payloads hosted on attacker-controlled infrastructure.

Use of Malicious Scripts – Executing scripts (e.g., ‘.vbs’, ‘.msi’) to establish persistence.

GuLoader is then launched resulting in the execution of PowerShell commands... In a recently observed incident involving XWorm malware... Upon execution, a PowerShell command was spawned to retrieve the XWorm payload from its Command-and-Control (C2) server.

attempted to lure victims into enabling malicious macros within email attachments... prompted victims to accept macros... Word documents containing malicious macros.

GuLoader can use a number of different APIs for discovery and execution.

Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада

This happens when macros are enabled by the victim or after successful exploitation of vulnerabilities like CVE-2017-11882 by the threat actors.

The ZIP archive contains an LNK file, which if interacted with, leads to the deployment of GuLoader.

GuLoader has relied upon users clicking on links to malicious documents.

The ZIP archive contains an LNK file, which if interacted with, leads to the deployment of GuLoader.

GuLoader is then launched resulting in the execution of PowerShell commands, establishing persistence via Registry Run Keys

В данной статье мы рассмотрим более продвинутый подход к инжекту - в его основе лежит вполне легальный механизм проецирования секций памяти "Mapping"...

Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада

Данный метод незаслуженно остаётся в тени упомянутого выше. В его основе лежит NtMapViewOfSection() из либы Ntdll.dll, которая используется малварью для скрытой инъекции кода в обход EDR. Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада

It then injects this decrypted payload to the targeted process or creates a child process of itself and overwrites the child process with the decrypted content from the image base 0x400000.

GuLoader is then launched resulting in the execution of PowerShell commands, establishing persistence via Registry Run Keys

В данной статье мы рассмотрим более продвинутый подход к инжекту - в его основе лежит вполне легальный механизм проецирования секций памяти "Mapping"...

Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада

Данный метод незаслуженно остаётся в тени упомянутого выше. В его основе лежит NtMapViewOfSection() из либы Ntdll.dll, которая используется малварью для скрытой инъекции кода в обход EDR. Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада

It then injects this decrypted payload to the targeted process or creates a child process of itself and overwrites the child process with the decrypted content from the image base 0x400000.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Tiếp theo sử dụng vòng lặp để quét toàn bộ vùng nhớ từ 0x00010000 tới 0x7FFFF000, gọi hàm ZwQueryVirtualMemory kiểm tra access protection của các vùng nhớ này... gặp chuỗi sẽ gọi hàm tính toán hash cho chuỗi đó và so sánh với các hash đã thiết lập trên Stack. | loader còn sử dụng thêm lệnh CPUID để kiểm tra xem chương trình có đang thực thi trong môi trường ảo hóa hay không

GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.

Debugger Anti-attach technique: The malware uses ZwSetInformationThread API to detach itself from the debugger.

Tiếp theo sử dụng vòng lặp để quét toàn bộ vùng nhớ từ 0x00010000 tới 0x7FFFF000, gọi hàm ZwQueryVirtualMemory kiểm tra access protection của các vùng nhớ này... gặp chuỗi sẽ gọi hàm tính toán hash cho chuỗi đó và so sánh với các hash đã thiết lập trên Stack. | loader còn sử dụng thêm lệnh CPUID để kiểm tra xem chương trình có đang thực thi trong môi trường ảo hóa hay không

GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.

Debugger Anti-attach technique: The malware uses ZwSetInformationThread API to detach itself from the debugger.

users received tax-themed malicious emails which contain a link to a password protected ZIP archive that impersonates a tax return

Over the last six years there has been an increased shift by malware authors to secure their C&C communications using the SSL/TLS protocol to stymie detection and blend in with normal traffic.

GuLoader can use HTTP to retrieve additional binaries.

GuLoader has the ability to download malware from Google Drive.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."