di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Malware-Blog.jpg

GuLoader, also commonly referred to as CloudEyE or vbdropper, was first noticed in the wild around December 2019, and has since been used to distribute malware at scale around the globe. Loader / downloader malware is first-stage malware that is designed to infect a target, and then help execute second-stage malware or malicious payloads. Loaders are typically used to launch Malware-as-a-Service (MaaS) schemes created by cybercriminals to provide paid access to servers and infrastructures to launch distributed malware campaigns. While we observed that GuLoader delivery methods vary, it’s most often used via malspam campaigns. GuLoader malware can be downloaded or created in various ways, but the most common one includes the use of a document attachment with a macro that will execute a malicious payload or an exploit like <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882">CVE-2017-11882</a>. GuLoader is unique in that it is written in <a href="https://en.wikipedia.org/wiki/Visual_Basic_(classic)">Visual Basic 6</a> and contains a <a href="https://en.wikipedia.org/wiki/Shellcode">Shellcode</a> payload wrapped inside. Yet, like many of today’s malware strains, GuLoader also uses a variety of self-defense mechanisms to evade detection and defense.<h4>The First Stage </h4>GuLoader begins with an attachment containing an Office document containing a hidden <a href="https://en.wikipedia.org/wiki/Object_Linking_and_Embedding">OLE embedded object</a> that is triggered by a macro.Notice in the image below the tiny black pixel circled in red. <img data-image="hjfatjqpytxo" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a80ed696dce3d46/61aec39cbcd235746e0413f3/image.png" data-sys-asset-uid="blt9a80ed696dce3d46" alt="image.png"/>Figure 1: MGuLoader malwareNext, a popup appears asking for permission to run (“WindowsUpdate.exe”); this is the GuLoader malware and this action will enable it to execute.<img data-image="cy7ekb1tuclg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta20cfbe96bab91ec/61aec3a8bcd235746e0413f7/image.png" data-sys-asset-uid="blta20cfbe96bab91ec" alt="image.png"/>Figure 2: A security prompt for GuLoader malware masked as “WindowsUpdate.exe”After examining the macro, we see that there is an object we likely didn’t notice when we first opened the document. If we reopen the document and go to the small pixel in the upper left corner, we can expand it to the original object size and see the embedded GuLoader malware. <img data-image="lh31fa5g0ybt" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6431ea5bf6140b4c/61aec3c3bcd235746e0413fb/image.png" data-sys-asset-uid="blt6431ea5bf6140b4c" alt="image.png"/>Figure 3: The VBA macro that triggers the GuLoader malware embedded in the document<img data-image="56jot8ih8ep5" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb3f9440e364c460d/61aec3d67b288471c602c40d/image.png" data-sys-asset-uid="bltb3f9440e364c460d" alt="image.png"/>Figure 4: The tiny pixel is now uncovered as a GuLoader executableThe malicious PE executable can also be created by the macros embedded in malicious Office files rather than being embedded inside the Office file, as shown in the example below.<img data-image="yqr21jk4upxv" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt391795754c6606c5/61aec3e1cf0d931e5942b258/image.png" data-sys-asset-uid="blt391795754c6606c5" alt="image.png"/>Figure 5: A VBS code from a script that was created from a different maldoc sampleThe script will create the GuLoader malware’s executable file as opposed to embedding it inside the OLE as shown in the previous example.<img data-image="9ewmb7ytpxxu" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0b958b2220d6e259/61aec3edf5ac2d2509ef0667/image.png" data-sys-asset-uid="blt0b958b2220d6e259" alt="image.png"/>Figure 6: PE header of GuLoader shows that it is written in Visual Basic<h4>The Second Stage</h4>The purpose of GuLoader is to download one or more remote administration tools (RAT), as well as info stealer trojans, including the following:<ul><li><a href="https://blog.morphisec.com/parallax-rat-active-status">Parallax RAT</a> - active since at least 2019</li><li><a href="https://attack.mitre.org/versions/v10/software/S0332/">Remcos RAT </a> - active since at least 2016</li><li><a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook">FormBook</a> - active since at least 2016</li><li><a href="https://attack.mitre.org/software/S0331/">Agent Tesla</a> - active since at least 2014</li><li><a href="https://attack.mitre.org/software/S0336/">NanoCore</a> - active since at least 2013</li><li><a href="https://attack.mitre.org/software/S0198/">NETWIRE</a> - active since at least 2012</li></ul>GuLoader: A Master of Self DefenseGuLoader is notorious for its use of obfuscation and anti-analysis/debugging/sandbox/emulation techniques.<ul><li>To bypass security software, GuLoader will search the NTDLL API functions loaded in memory for well-known locations where security products place their <a href="https://en.wikipedia.org/wiki/Hooking">hooks.</a> It will then intercept API calls and control the flow detect malicious behavior associated with those API functions. Once found, it will “unhook” those hooks by restoring the original NTDLL’s API functions control flows. </li><li>Use of <a href="https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getprocaddress">GetProcAddress</a>. When a program is executed, it determines which Windows API functions calls to use from the Import Address Table (IAT) located in the PE header. This process is called dynamic linking. Since the imports contain information describing the program’s capabilities, it has value for analysis and debugging. For example, if SetWindowsHookExA() is imported, this might be an indication that the program is capable of keystroke logging. In order to obfuscate and mask Windows API calls used, GuLoader will import GetProcAddress and use it to resolve any API function’s address it wishes to use from user32.dll loaded in memory and achieve the possibility of using it without the need to import it. GuLoader’s PE files won’t have all the API functions it plans to use declared in IAT, but will include only the generic GetProcAddress() (among others) while covering its true intentions from anti-malware solutions and/or analysts.</li><li>Use of <a href="https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-enumwindows">EnumWindows</a>. This sandbox or emulation detection is done by enumerating and counting all top-level windows on the screen. If there is a low number of windows opened, the malware will self-terminate without executing any malicious activity in order to avoid being detected during the analysis process.</li><li>Use of <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntsetinformationthread">NtSetInformationThread</a> with ThreadHideFromDebugger parameter. This debugging tampering method will cause a crash in the debugged application when a <a href="https://en.wikipedia.org/wiki/Breakpoint">breakpoint</a> <a href="https://en.wikipedia.org/wiki/Breakpoint"></a> is hit in a hidden thread.</li><li>DbgBreakPoint API is called when a debugger attaches to a running process. GuLoader will patch this API by replacing DbgBreakPoint’s original assembly instructions with with 0x90 instructions/NOP (no operation). Similarly, to manipulate DbgBreakPoint, it will replace other debugging API calls with dummy calls to cause a crash during the debugging process.</li><li>Adding junk instruction to the shellcode itself, which doesn’t have any effect other than delaying the analysis process.</li></ul><img data-image="5rkldyre820y" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt647504bd1467aaea/61aec3fcf5ac2d2509ef066b/image.png" data-sys-asset-uid="blt647504bd1467aaea" alt="image.png"/>Figure 7: Anti-VM alert message when executing the sample in a VM environment Upon successful execution, GuLoader will perform a code injection technique called <a href="https://www.deepinstinct.com/blog/malware-evasion-techniques-part-1-process-injection-and-manipulation">“Process Hollowing”</a> during which malicious code is injected into a legitimate processes address space after it has been put in a suspended state. It then unmaps (“hollows”) its memory and injects its malicious code that will then be executed under that process. The purpose of using this technique is to hide the malicious activity among other legitimate processes running in the system, avoiding defenses meant to detect anomalies among the running processes. GuLoader’s prime targets for hollowing and injecting the malicious payload typically include the following:<ul><li><a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool">regAsm.exe</a> - Assembly Registration tool</li><li><a href="https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild?view=vs-2019">MSBuild.exe</a> - Microsoft Build Engine (a platform for building applications)</li><li><a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool">RegSvcs.exe</a> – .NET Services Installation tool</li></ul><h4>The Final Stage</h4>Once GuLoader successfully performs the “process hollowing,” it will download and execute the target malware from a remote location. In some occasions, this location is Google Drive or OneDrive to avoid network-based detections as the domains of these vendors are usually classified as benign and trusted.<img data-image="jsv2zgfl5i7q" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfa7cbac36f3e431f/61aec406ee9cbf746f324357/image.png" data-sys-asset-uid="bltfa7cbac36f3e431f" alt="image.png"/>Figure 8: GuLoader GET request for Remcos RAT<img data-image="asco3t1phnz5" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt03e370b369581255/61aec43106b2fc23d9312b0a/image.png" data-sys-asset-uid="blt03e370b369581255" alt="image.png"/>Figure 9: Remcos RAT downloaded (<a href="https://en.wikipedia.org/wiki/DOS_MZ_executable">MZ magic bytes hint of a PE file</a>)<h4>Widespread Reach of GuLoader</h4>GuLoader is very active and is a considerable threat to any environment. In September 2021, a campaign <a href="https://blogs.infoblox.com/cyber-threat-intelligence/cyber-campaign-briefs/guloader-delivers-remcos-rat/">spreading a Remcos</a> Remote Access Trojan was identified that utilized GuLoader. Another noticeable campaign that was documented in January 2021 targeted <a href="https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/">organizations in Italy</a>, and spread GuLoader via malspam with a fake RFQ (Request for Quotation) cover story.<img data-image="14e6z9k6pvmw" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5fe57217d749e02f/61aec45d0a2c0d3da1c1708b/image.png" data-sys-asset-uid="blt5fe57217d749e02f" alt="image.png"/>Figure 10: Number of GuLoader samples submitted to <a href="https://bazaar.abuse.ch/browse.php">MalwareBazaar</a> during January - October 2021. Notice the spikes in January - February and September - October.<h4>Conclusion</h4>A GuLoader infection can have serious consequences on an infected organization, and its effectiveness ensures it will be a significant threat for years to come.Deep Instinct successfully prevents malware like GuLoader, detecting and stopping it before it can enter a customers’ environment. Deep Instinct prevents the malicious payloads regardless of the deployment method exploited. Our deep learning framework allows Deep Instinct to prevent &gt;99% of unknown threats. It is also incredibly precise, ensuring false positives remain &lt;0.1%If you’d like to learn more about our malware, ransomware, and zero-day prevention capabilities – including our industry best $3M no-ransomware guarantee – we’d be delighted to <a href="https://www.deepinstinct.com/request-demo/">give you a demo.</a>IOC’s:Docx: 4797b4b672a93427a126361e058d86c443c4956255624bce2ff2e5d129f88eaaVbs: 6394c4e126b8ef4cf8e66d43a54cfd42fd86b3003292f621f0ca427bc12051d8Pcap taken from: <a href="https://www.malware-traffic-analysis.net/2021/09/03/index.html">malware-traffic</a> Read more:<a href="https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/">https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/</a><a href="https://www.gend.co/blog/netskope-cloud-threats-memo-january-28-2021">https://www.gend.co/blog/netskope-cloud-threats-memo-january-28-2021</a><a href="https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software">https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software</a>

[Down]loaded by GuLoader Malware

Announcing DSX for Cloud - Amazon S3, natively integrated zero-day data security for AWS S3.