Getting gooey with GULOADER: deobfuscating the downloader

The GuLoader, also known as CloudEye, is a sophisticated malware downloader that has been active since at least December 2019. Here are key aspects of its operation and analysis based on various sources:

• Deobfuscation in Malware Analysis: Deobfuscating code is a critical step in malware analysis. Malware authors often use various obfuscation techniques to make their programs difficult to understand and analyze. GuLoader is known for its heavy use of obfuscation, which poses challenges to static analysis. This complexity necessitates advanced methods to reverse-engineer and understand the malware's functionality.
• Advanced Downloader Using Shellcode: GuLoader utilizes shellcode wrapped in a VB6 executable, which changes with each campaign to evade antivirus detections. The shellcode is encrypted and heavily obfuscated, making it a challenge to analyze. This approach demonstrates the malware's adaptability and sophistication in avoiding detection.
• Widespread and Ongoing Development: GuLoader has been used in a large number of attacks to deliver a wide range of "most wanted" malware. Its activity spans over three years, and it continues to undergo development. This ongoing evolution indicates that GuLoader remains a significant threat, with its operators actively working to enhance its capabilities and maintain its effectiveness in cyber attacks.
• Control Flow Obfuscation Technique: Researchers at Unit 42 analyzed a control flow obfuscation technique used by GuLoader to create an IDA Processor module extension script, which allows for the automatic deobfuscation of the sample. This analysis provides valuable insights into the malware's techniques and aids in the development of more effective countermeasures against it.

In conclusion, GuLoader is a highly evasive malware downloader with advanced obfuscation techniques and a capability to deliver various types of malware. Its continuous development and adaptability make it a persistent threat in the cybersecurity landscape. Understanding and deobfuscating GuLoader is crucial for researchers and cybersecurity professionals to develop effective defenses against this and similar malware threats.

IoC

    IPv4

• 101.99.75.183

SHA256

• 6ae7089aa6beaa09b1c3aa3ecf28a884d8ca84f780aab39902223721493b1f99

SHA1

• 6526c781106b303b7f21861e8bcc255d4f356143

MD5

• 9b40ae8c6dc8f35af3535a7b30c51d80

REFERENCES

• https://any.run/cybersecurity-blog/deobfuscating-guloader/
• https://www.crowdstrike.com/blog/guloader-malware-analysis/
• https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/#:~:text=%23%20%E3%80%902%E2%80%A0Cloud,is%20still%20undergoing%20further%20development
• https://unit42.paloaltonetworks.com/guloader-variant-anti-analysis/#:~:text=%23%20%E3%80%903%E2%80%A0Defeating%20Guloader%20Anti,can%20deobfuscate%20the%20sample%20automatically
• https://otx.alienvault.com/pulse/65720200ae1af0d2096610bf

TAGS

guloader, shellcode, nsis, miasm, cloudeye