di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Storage

Prevention for Applications

Prevention for Endpoints

Data Security: Powered by Deep Instinct

Deep Learning: Prevention-First Cybersecurity

Products

>99% Threat Accuracy

Prevent Ransomware

Prevent Zero-Day Attacks

Why Deep Instinct

Extend & Enhance EDR/XDR

+ Microsoft Defender

+ Tanium

Legacy AV

Enhance Existing Cyber Tools

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Events & Webinars

Resources

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick links

EXPLORE THE PREDICTIVE PREVENTION PLATFORM

End-to-end predictive prevention platform built on a deep learning framework that protects storage, applications, and endpoints.

Prevent >99% of zero-day exploits, ransomware, and unknown threats in your NAS and cloud storage repositories.

Proactively prevent malicious files from entering your storage environment through application uploads by customers, employees, and third parties.

Prevent known and unknown malware, zero-day exploits, ransomware, and script-based attacks before they execute on the endpoint – faster than a blink of an eye.

Leverage advanced predictive prevention technology to protect data across your entire environment.

Data Security: Powered By Deep Instinct

Deep Instinct is the only deep learning framework in the world built from the ground up for cybersecurity.

Unparalleled Prevention

Leverage deep learning to deliver highly accurate threat detection and reduce false positives in a rapidly evolving threat landscape.

Stop threats using real-time classification and prevention techniques to ensure robust and efficient cybersecurity.

Proactively stop zero-day threats in <20ms with unparalleled accuracy and minimal false positives.

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ MICROSOFT DEFENDER

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ TANIUM

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

LEGACY AV

Threat Research

Voice Of SecOps

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Malware-Blog.jpg

GuLoader, also commonly referred to as CloudEyE or vbdropper, was first noticed in the wild around December 2019, and has since been used to distribute malware at scale around the globe. Loader / downloader malware is first-stage malware that is designed to infect a target, and then help execute second-stage malware or malicious payloads. Loaders are typically used to launch Malware-as-a-Service (MaaS) schemes created by cybercriminals to provide paid access to servers and infrastructures to launch distributed malware campaigns. While we observed that GuLoader delivery methods vary, it’s most often used via malspam campaigns. GuLoader malware can be downloaded or created in various ways, but the most common one includes the use of a document attachment with a macro that will execute a malicious payload or an exploit like <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882">CVE-2017-11882</a>. GuLoader is unique in that it is written in <a href="https://en.wikipedia.org/wiki/Visual_Basic_(classic)">Visual Basic 6</a> and contains a <a href="https://en.wikipedia.org/wiki/Shellcode">Shellcode</a> payload wrapped inside. Yet, like many of today’s malware strains, GuLoader also uses a variety of self-defense mechanisms to evade detection and defense.<h4>The First Stage </h4>GuLoader begins with an attachment containing an Office document containing a hidden <a href="https://en.wikipedia.org/wiki/Object_Linking_and_Embedding">OLE embedded object</a> that is triggered by a macro.Notice in the image below the tiny black pixel circled in red. <img data-image="hjfatjqpytxo" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a80ed696dce3d46/61aec39cbcd235746e0413f3/image.png" data-sys-asset-uid="blt9a80ed696dce3d46" alt="image.png"/>Figure 1: MGuLoader malwareNext, a popup appears asking for permission to run (“WindowsUpdate.exe”); this is the GuLoader malware and this action will enable it to execute.<img data-image="cy7ekb1tuclg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta20cfbe96bab91ec/61aec3a8bcd235746e0413f7/image.png" data-sys-asset-uid="blta20cfbe96bab91ec" alt="image.png"/>Figure 2: A security prompt for GuLoader malware masked as “WindowsUpdate.exe”After examining the macro, we see that there is an object we likely didn’t notice when we first opened the document. If we reopen the document and go to the small pixel in the upper left corner, we can expand it to the original object size and see the embedded GuLoader malware. <img data-image="lh31fa5g0ybt" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6431ea5bf6140b4c/61aec3c3bcd235746e0413fb/image.png" data-sys-asset-uid="blt6431ea5bf6140b4c" alt="image.png"/>Figure 3: The VBA macro that triggers the GuLoader malware embedded in the document<img data-image="56jot8ih8ep5" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb3f9440e364c460d/61aec3d67b288471c602c40d/image.png" data-sys-asset-uid="bltb3f9440e364c460d" alt="image.png"/>Figure 4: The tiny pixel is now uncovered as a GuLoader executableThe malicious PE executable can also be created by the macros embedded in malicious Office files rather than being embedded inside the Office file, as shown in the example below.<img data-image="yqr21jk4upxv" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt391795754c6606c5/61aec3e1cf0d931e5942b258/image.png" data-sys-asset-uid="blt391795754c6606c5" alt="image.png"/>Figure 5: A VBS code from a script that was created from a different maldoc sampleThe script will create the GuLoader malware’s executable file as opposed to embedding it inside the OLE as shown in the previous example.<img data-image="9ewmb7ytpxxu" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0b958b2220d6e259/61aec3edf5ac2d2509ef0667/image.png" data-sys-asset-uid="blt0b958b2220d6e259" alt="image.png"/>Figure 6: PE header of GuLoader shows that it is written in Visual Basic<h4>The Second Stage</h4>The purpose of GuLoader is to download one or more remote administration tools (RAT), as well as info stealer trojans, including the following:<ul><li><a href="https://blog.morphisec.com/parallax-rat-active-status">Parallax RAT</a> - active since at least 2019</li><li><a href="https://attack.mitre.org/versions/v10/software/S0332/">Remcos RAT </a> - active since at least 2016</li><li><a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook">FormBook</a> - active since at least 2016</li><li><a href="https://attack.mitre.org/software/S0331/">Agent Tesla</a> - active since at least 2014</li><li><a href="https://attack.mitre.org/software/S0336/">NanoCore</a> - active since at least 2013</li><li><a href="https://attack.mitre.org/software/S0198/">NETWIRE</a> - active since at least 2012</li></ul>GuLoader: A Master of Self DefenseGuLoader is notorious for its use of obfuscation and anti-analysis/debugging/sandbox/emulation techniques.<ul><li>To bypass security software, GuLoader will search the NTDLL API functions loaded in memory for well-known locations where security products place their <a href="https://en.wikipedia.org/wiki/Hooking">hooks.</a> It will then intercept API calls and control the flow detect malicious behavior associated with those API functions. Once found, it will “unhook” those hooks by restoring the original NTDLL’s API functions control flows. </li><li>Use of <a href="https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getprocaddress">GetProcAddress</a>. When a program is executed, it determines which Windows API functions calls to use from the Import Address Table (IAT) located in the PE header. This process is called dynamic linking. Since the imports contain information describing the program’s capabilities, it has value for analysis and debugging. For example, if SetWindowsHookExA() is imported, this might be an indication that the program is capable of keystroke logging. In order to obfuscate and mask Windows API calls used, GuLoader will import GetProcAddress and use it to resolve any API function’s address it wishes to use from user32.dll loaded in memory and achieve the possibility of using it without the need to import it. GuLoader’s PE files won’t have all the API functions it plans to use declared in IAT, but will include only the generic GetProcAddress() (among others) while covering its true intentions from anti-malware solutions and/or analysts.</li><li>Use of <a href="https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-enumwindows">EnumWindows</a>. This sandbox or emulation detection is done by enumerating and counting all top-level windows on the screen. If there is a low number of windows opened, the malware will self-terminate without executing any malicious activity in order to avoid being detected during the analysis process.</li><li>Use of <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntsetinformationthread">NtSetInformationThread</a> with ThreadHideFromDebugger parameter. This debugging tampering method will cause a crash in the debugged application when a <a href="https://en.wikipedia.org/wiki/Breakpoint">breakpoint</a> <a href="https://en.wikipedia.org/wiki/Breakpoint"></a> is hit in a hidden thread.</li><li>DbgBreakPoint API is called when a debugger attaches to a running process. GuLoader will patch this API by replacing DbgBreakPoint’s original assembly instructions with with 0x90 instructions/NOP (no operation). Similarly, to manipulate DbgBreakPoint, it will replace other debugging API calls with dummy calls to cause a crash during the debugging process.</li><li>Adding junk instruction to the shellcode itself, which doesn’t have any effect other than delaying the analysis process.</li></ul><img data-image="5rkldyre820y" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt647504bd1467aaea/61aec3fcf5ac2d2509ef066b/image.png" data-sys-asset-uid="blt647504bd1467aaea" alt="image.png"/>Figure 7: Anti-VM alert message when executing the sample in a VM environment Upon successful execution, GuLoader will perform a code injection technique called <a href="https://www.deepinstinct.com/blog/malware-evasion-techniques-part-1-process-injection-and-manipulation">“Process Hollowing”</a> during which malicious code is injected into a legitimate processes address space after it has been put in a suspended state. It then unmaps (“hollows”) its memory and injects its malicious code that will then be executed under that process. The purpose of using this technique is to hide the malicious activity among other legitimate processes running in the system, avoiding defenses meant to detect anomalies among the running processes. GuLoader’s prime targets for hollowing and injecting the malicious payload typically include the following:<ul><li><a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool">regAsm.exe</a> - Assembly Registration tool</li><li><a href="https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild?view=vs-2019">MSBuild.exe</a> - Microsoft Build Engine (a platform for building applications)</li><li><a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool">RegSvcs.exe</a> – .NET Services Installation tool</li></ul><h4>The Final Stage</h4>Once GuLoader successfully performs the “process hollowing,” it will download and execute the target malware from a remote location. In some occasions, this location is Google Drive or OneDrive to avoid network-based detections as the domains of these vendors are usually classified as benign and trusted.<img data-image="jsv2zgfl5i7q" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfa7cbac36f3e431f/61aec406ee9cbf746f324357/image.png" data-sys-asset-uid="bltfa7cbac36f3e431f" alt="image.png"/>Figure 8: GuLoader GET request for Remcos RAT<img data-image="asco3t1phnz5" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt03e370b369581255/61aec43106b2fc23d9312b0a/image.png" data-sys-asset-uid="blt03e370b369581255" alt="image.png"/>Figure 9: Remcos RAT downloaded (<a href="https://en.wikipedia.org/wiki/DOS_MZ_executable">MZ magic bytes hint of a PE file</a>)<h4>Widespread Reach of GuLoader</h4>GuLoader is very active and is a considerable threat to any environment. In September 2021, a campaign <a href="https://blogs.infoblox.com/cyber-threat-intelligence/cyber-campaign-briefs/guloader-delivers-remcos-rat/">spreading a Remcos</a> Remote Access Trojan was identified that utilized GuLoader. Another noticeable campaign that was documented in January 2021 targeted <a href="https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/">organizations in Italy</a>, and spread GuLoader via malspam with a fake RFQ (Request for Quotation) cover story.<img data-image="14e6z9k6pvmw" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5fe57217d749e02f/61aec45d0a2c0d3da1c1708b/image.png" data-sys-asset-uid="blt5fe57217d749e02f" alt="image.png"/>Figure 10: Number of GuLoader samples submitted to <a href="https://bazaar.abuse.ch/browse.php">MalwareBazaar</a> during January - October 2021. Notice the spikes in January - February and September - October.<h4>Conclusion</h4>A GuLoader infection can have serious consequences on an infected organization, and its effectiveness ensures it will be a significant threat for years to come.Deep Instinct successfully prevents malware like GuLoader, detecting and stopping it before it can enter a customers’ environment. Deep Instinct prevents the malicious payloads regardless of the deployment method exploited. Our deep learning framework allows Deep Instinct to prevent &gt;99% of unknown threats. It is also incredibly precise, ensuring false positives remain &lt;0.1%If you’d like to learn more about our malware, ransomware, and zero-day prevention capabilities – including our industry best $3M no-ransomware guarantee – we’d be delighted to <a href="https://www.deepinstinct.com/request-demo/">give you a demo.</a>IOC’s:Docx: 4797b4b672a93427a126361e058d86c443c4956255624bce2ff2e5d129f88eaaVbs: 6394c4e126b8ef4cf8e66d43a54cfd42fd86b3003292f621f0ca427bc12051d8Pcap taken from: <a href="https://www.malware-traffic-analysis.net/2021/09/03/index.html">malware-traffic</a> Read more:<a href="https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/">https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/</a><a href="https://www.gend.co/blog/netskope-cloud-threats-memo-january-28-2021">https://www.gend.co/blog/netskope-cloud-threats-memo-january-28-2021</a><a href="https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software">https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software</a>

[Down]loaded by GuLoader Malware

Announcing Deep Instinct Prevention for Storage for cloud storage and NAS environments