Loading malware…
GuLoader, also known as CloudEyE, is a Windows malware loader/downloader widely used in cybercrime delivery chains to fetch and execute second-stage payloads. It has been observed delivering a broad range of commodity malware, including remote access trojans and information stealers such as FormBook, XLoader, Remcos, Agent Tesla, LokiBot, NanoCore, NetWire, Quasar RAT, Vidar, and AZORult. The malware is commonly associated with phishing-driven campaigns and malware-as-a-service style operations, and has been linked in reporting to activity involving groups such as TA505, TA542, Gorgon APT, and RATicate.
GuLoader is notable for staging encrypted payloads on legitimate cloud and web services, including platforms such as Google Drive and OneDrive, then retrieving them over HTTP or web-service channels for local execution. It commonly decrypts downloaded content and executes it either by injecting shellcode into a donor process or by hollowing or overwriting a newly created child process. RegAsm has been repeatedly observed as a donor process in these chains. GuLoader also uses native Windows APIs for memory allocation, discovery, and execution, and has been documented using shellcode-based loaders and cross-architecture injection techniques such as Heaven’s Gate to reach 64-bit targets from WoW64 processes.
The malware incorporates substantial anti-analysis and defense-evasion functionality. Reported behaviors include anti-VM and anti-sandbox checks, time-based anti-debugging, debugger-detach techniques, patching of debugging-related functions, restoration of hooked API bytes, and self-deletion from temporary directories after execution. Persistence has also been observed through Windows RunOnce registry autoruns.
Distribution has frequently relied on phishing emails and malicious documents, including Word files with embedded macros, archive attachments, invoice and shipping-themed lures, COVID-19-themed spam, and links to malicious documents or landing content. Some campaigns also used exploitation of CVE-2017-11882 in Microsoft Office as part of the infection chain. GuLoader primarily targets Windows environments and is best characterized as a downloader used to deliver follow-on malware rather than as the final payload itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
These GuLoader exe files get downloaded and saved to the system after the Coronavirus spam document is opened. This happens when macros are enabled by the victim or after successful exploitation of vulnerabilities like CVE-2017-11882 by the threat actors. | In this blog, we will dig deeper into the GuLoader malware which comes attached as a spam document in such emails. This malware is a VBdownloader...
Threat Actors (TAs) leveraging a Remote Code Execution (RCE) vulnerability, identified as CVE-2023-38831, to deliver their payload on compromised systems... The aforementioned vulnerability allows the WinRAR application to extract and execute the malicious script when a user tries to open a benign file within the archive. | Moreover, they observed that several other malware families, including GuLoader and Remcos RAT, were also utilizing the same exploit as a means of delivery.
実行ファイルが使用されるケースでは、実行ファイル自体が情報窃取型マルウェア本体である場合と、実行ファイルがGuLoader(別名:CloudEyE)と呼ばれるダウンローダである場合があります。
実行ファイルが使用されるケースでは、実行ファイル自体が情報窃取型マルウェア本体である場合と、実行ファイルがGuLoader(別名:CloudEyE)と呼ばれるダウンローダである場合があります。
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this blog, we will dig deeper into the GuLoader malware which comes attached as a spam document in such emails. This malware is a VBdownloader...
In this blog, we will dig deeper into the GuLoader malware which comes attached as a spam document in such emails. This malware is a VBdownloader...
Initially identified (by researchers at CheckPoint) as Guloader, the new Visual Basic 6-based installer was tied to a publicly-marketed installation builder called CloudEyE.
In this blog, we will dig deeper into the GuLoader malware which comes attached as a spam document in such emails. This malware is a VBdownloader...
Earlier this April, the Redmond-based company warned of several phishing campaigns leveraging tax-related themes to deploy malware such as Latrodectus, AHKBot, GuLoader, and BruteRatel C4 (BRc4). The phishing pages, it added, were delivered via RaccoonO365, with one such campaign attributed to an initial access broker called Storm-0249.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Use of Malicious Scripts – Executing scripts (e.g., ‘.vbs’, ‘.msi’) to establish persistence.
attempted to lure victims into enabling malicious macros within email attachments... prompted victims to accept macros... Word documents containing malicious macros.
This happens when macros are enabled by the victim or after successful exploitation of vulnerabilities like CVE-2017-11882 by the threat actors.
has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder. | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce ... HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx ... reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"
GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.
Once the GuLoader binary launches, it sleeps for roughly 30 to 60 seconds and then performs process hollowing to one of two IE utilities, the Internet Explorer Low-MIC Utility Tool, ielowutil.exe or ieinstal.exe.
It then injects this decrypted payload to the targeted process or creates a child process of itself and overwrites the child process with the decrypted content from the image base 0x400000.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder. | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce ... HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx ... reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"
The GuLoader VBScript is obfuscated and has junk code with random comments... The 2 nd stage Powershell script contains XOR encoded strings that contain the logical code that is responsible for downloading the GuLoader shellcode.
GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.
Once the GuLoader binary launches, it sleeps for roughly 30 to 60 seconds and then performs process hollowing to one of two IE utilities, the Internet Explorer Low-MIC Utility Tool, ielowutil.exe or ieinstal.exe.
It then injects this decrypted payload to the targeted process or creates a child process of itself and overwrites the child process with the decrypted content from the image base 0x400000.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Tiếp theo sử dụng vòng lặp để quét toàn bộ vùng nhớ từ 0x00010000 tới 0x7FFFF000, gọi hàm ZwQueryVirtualMemory kiểm tra access protection của các vùng nhớ này... gặp chuỗi sẽ gọi hàm tính toán hash cho chuỗi đó và so sánh với các hash đã thiết lập trên Stack. | loader còn sử dụng thêm lệnh CPUID để kiểm tra xem chương trình có đang thực thi trong môi trường ảo hóa hay không
Tiếp theo sử dụng vòng lặp để quét toàn bộ vùng nhớ từ 0x00010000 tới 0x7FFFF000, gọi hàm ZwQueryVirtualMemory kiểm tra access protection của các vùng nhớ này... gặp chuỗi sẽ gọi hàm tính toán hash cho chuỗi đó và so sánh với các hash đã thiết lập trên Stack. | loader còn sử dụng thêm lệnh CPUID để kiểm tra xem chương trình có đang thực thi trong môi trường ảo hóa hay không
GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.
294 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
122 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
A shellcode-based, memory-resident loader/downloader attributed via C2 infrastructure in this campaign. It is described as running entirely in memory and commonly used to drop infostealers such as Lumma and Vidar and remote access tools including Remcos and AgentTesla.
Mentioned as a malware family that uses the resource section to hide payloads.
Gremlin stealer uses the resource section to mirror the tactics of several high-profile malware families that frequently use this area for payload obfuscation, including: Agent Tesla, GuLoader, LokiBot, Quasar RAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.