Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware, which ClearSky calls Gholee, has other names among other cybersecurity companies, several of which likewise found links between it and Iran.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
the function ShellExecte is used to run it under cmd.exe /C and Rundll32
That email contained a malicious excel file, which once opened and its VBA code executed, would infect the victim’s computer.
In order to avoid detection by protection measures such as computer antivirus and intrusion detection systems, ASCII characters codes are used instead of actual characters.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Espionage-focused malware delivered via spear-phishing and follow-on social engineering pages. Once installed, it gains access to victims’ emails, documents, and other communications, which the operator can remotely access and copy. It is described as existing without overtly malicious side effects and not destroying accessed data.
Gholee is a macro-delivered remote access trojan. A malicious Excel file reconstructs and drops an obfuscated DLL, saves it as NTUSER.data.{GUID}.dll, and executes it via cmd.exe and rundll32. The DLL includes anti-debugging and anti-sandbox checks and communicates with command-and-control infrastructure over SSL/HTTP on port 443.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.