Since the beginning of the year, there have been many cases of malicious campaigns involving GuLoader. It is a sophisticated shellcode-based downloader, capable of evading detection by traditional anti-malware solutions (including sandbox activity), through advanced evasion and encryption techniques.
In the various campaigns involving GuLoader, distribution usually took place via phishing e-mails.
This distribution took place by inducing users to open an attached PDF file, which redirected them to a cloud platform, where a ZIP file containing the malicious executable was available for download.
In today's report, we will analyse a GuLoader sample intercepted by our Malware Lab, describing its initial stages and evasive techniques, which aimed to download an executable of the Remcos malware.
The analysis of the latter will be dealt with in the second part of the report.
If you wish to learn more, here is the link to our full report.
In addition, you can subscribe to the specific mailing list Cyber Studios by Tinexta Defence, to receive updates on upcoming research: https://tinextadefence.it/mailing-list-cyber-studios/
