Summary:
GuLoader is a well-known downloader used in numerous cyber-attacks to distribute dangerous malware. It has been active for over three years and continues to be updated with new anti-analysis techniques, making it difficult to analyze. The latest version of GuLoader evades detection completely, ensuring that its malicious payloads go undetected as well. The downloader encrypts its payload, including PE headers, enabling threat actors to store them on popular cloud services, bypass antivirus software, and keep the payloads accessible for an extended period.[/subscribe_to_unlock_form]
Summary:
GuLoader is a well-known downloader used in numerous cyber-attacks to distribute dangerous malware. It has been active for over three years and continues to be updated with new anti-analysis techniques, making it difficult to analyze. The latest version of GuLoader evades detection completely, ensuring that its malicious payloads go undetected as well. The downloader encrypts its payload, including PE headers, enabling threat actors to store them on popular cloud services, bypass antivirus software, and keep the payloads accessible for an extended period.[emaillocker id="1283"]
The latest versions of GuLoader are implemented as VBScript and NSIS installer variants. The VBScript variant stores the encrypted shellcode on a remote server, typically on Google Drive. The VBScript contains obfuscated PowerShell code, along with random comments and useless commands, which is executed either through IEX command or passed to the PowerShell interpreter in the SysWOW64 folder. The script allocates memory, downloads data from the Google Drive link, saves it to a temporary file, and decodes it using BASE64. The decoded data includes an obfuscated shellcode that decrypts the main part of the shellcode. Control is transferred to the decryptor using the CallWindowsProc callback function, along with the address of the encrypted shellcode and the NtProtectVirtualMemory function.
Execution Flow
The latest version of GuLoader, used in both VBScript and NSIS variants, incorporates several anti-analysis techniques. These include sandbox evasion techniques, such as VM detection, hypervisor checks, and scanning for QEMU-related files. It also employs anti-debugging methods by hooking debugger-related functions and hiding the main thread from debuggers. A notable addition in the new version is a technique that disrupts code execution flow by throwing multiple exceptions and handling them in a vector exception handler. The exceptions are caused by accessing invalid memory, setting the Trap Flag, and using int3 instructions. The exception handler dynamically calculates jump addresses to redirect program execution. The code is obfuscated, making analysis challenging. GuLoader's payload decryption key is stored in an obfuscated manner, and the payload is decrypted using XOR operations. The decryption algorithm remains similar to previous versions.
GuLoader remains a significant threat as its developers continually enhance its capabilities. A new technique involves storing encrypted shellcode on the cloud and using a VBScript to download it, making it less suspicious to victims. The use of encryption and storing payloads separately makes them undetectable by antivirus software. Google Drive is frequently used to host malicious payloads, allowing them to evade antivirus protection for extended periods.
Threat Profile:
References:
The following reports contain further technical details:
https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/
[/emaillocker]