GuLoader Sample: 0288DB1418CF2C5F

GuLoader Malware Analizi

Dosya Ozellikleri

SHA256: 0288db1418cf2c5f0be529a5e63c4f8b6c04c6be5a61fbc6dde28973cfb8428c

MD5: a4a84d4ba76194291d540cbadf9a5fd2

Dosya Tipi: exe

Boyut: 1,033,328 byte

Ilk Gorulme: 2025-11-10

AV Imzasi: GuLoader

Imphash: b34f154ec913d2d2c435cbd644e91687

Raporlayan: threatcat_ch

Etiketler: exe, GuLoader, signed

Statik analiz: metadata tabanli (ornek indirilmedi)

GuLoader — Malware Profile

GuLoader/CloudEyE NSIS/VB dropper. recibo Ispanyolca makbuz. Çift locale tespiti. Registry silme.

Malware Type

Loader

Programming Language

C2 Protocol

HTTPS

Target Systems

Windows

Also Known As (AKA)

CloudEyE

Technical Details

Varyanta gore C/C#/VBS/PS1, anti-analysis (VM/debugger check), persistence (Registry/Task Scheduler/Startup folder), payload decryption ve injection (shellcode/PE), fileless execution teknikleri

Capabilities & Behavior

Payload İndirme

Süreç Enjeksiyonu

Modüler Mimari

Kimlik Bilgisi Hırsızlığı

Yanal Hareket

Kalıcılık

Anti-VM/Sandbox

İkincil Payload Dağıtımı

IOC List (1 indicators)

IOC — GuLoader

# FILEPATH
0288db1418cf2c5f0be529a5e63c4f8b6c04c6be5a61fbc6dde28973cfb8428c

Type	Value	Note
filepath	0288db1418cf2c5f0be529a5e63c4f8b6c04c6be5a61fbc6dde28973cfb8428c	PDB

GuLoader — Go to Full Profile →

C2 Servers (4 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
45.155.37.29	ip	443	HTTPS	inactive	RU
onedrive-cloud-storage.com	domain	443	HTTPS	inactive	US
179.60.150.11	ip	80	HTTP	inactive	SE
185.250.151.13	ip	443	HTTPS	inactive	DE

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.