Categories
Audio Sources - Full Text Articles

GuLoader implements new evasion techniques

Listen to this article

Cybersecurity researchers exposed new evasion techniques adopted by an advanced malware downloader calledĀ GuLoader.

CrowdStrike researchers d a detailed multiple evasion techniques implemented by an advanced malware downloader calledĀ GuLoader (aka CloudEyE).

GuLoader uses a polymorphic shellcode loader to avoid traditional security solutions, the experts mapped all embedded DJB2 hash values for every API used by the malicious code.

The malware uses an anti-analysis technique to avoid execution in virtualized environments.

ā€œIn dissecting GuLoaderā€™s shellcode, CrowdStrike revealed a new anti-analysis technique meant to detect if the malware is running in a hostile environment by scanning the entire process memory for any Virtual Machine (VM)-related strings.ā€ reads the analysis published by CrowdStrike.

ā€œNew redundant code injection mechanism means to ensure code execution by usingĀ  inline assembly to bypass user mode hooks from security solutions.ā€

GuLoader first appeared on the threat landscape in 2019, it was used by threat actors to download multiple remote access trojans (RATs) such as AgentTesla, FormBook, Nanocore, NETWIRE and the Parallax RAT.

Early versions of GuLoader were distributed via spam messages using attachments containing the malicious executable. Recent variants were delivered via a Visual Basic Script (VBS) file.

ā€œGuLoader also started employing advanced anti-analysis techniques to evade detection, such as anti-debug, anti-sandbox, anti-VM and anti-detection to make analysis difficult.ā€ reads the analysis.

A recent GuLoader variant analyzed by the experts exhibits a multistage deployment:

  • The first stageĀ uses a VBS dropper file to drop a second-stage packed payload into a registry key. It then uses a PowerShell scriptĀ to execute and unpack the second stage payload from the registry key within memory.Ā 
  • TheĀ second stageĀ payload performs all anti-analysis routines (described below),Ā creates a Windows process (e.g., an ieinstal.exe) and injects the same shellcode into the new process.
  • The third stageĀ reimplements all the anti-analysis techniques, downloads the final payload from a remote serverĀ and executes itĀ on the victimā€™s machine.

The malware implements anti-debugging and anti-disassembling checks to detect the presence of breakpoints used for the analysis of code.

GuLoader

The researchers also noticed the use of a redundant code injection mechanism to avoidĀ NTDLL.dllĀ hooks used by antivirus and EDR solutions to detect malicious activities.

ā€œIt then maps that section via NtMapViewofSection on the suspended process.ā€ continues the analysis.Ā ā€œIf this injection technique fails, it uses the following redundancy method:

a.Ā NtAllocateVirtualMemoryĀ by invoking the inline assembly instructionsĀ (without calling ntdll.dll,Ā  to bypass AV/EDR User Mode hooks) of that function, using the following assembly stub:

mov eax,18Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā  
mov edx,ntdll.77178850Ā Ā Ā Ā Ā Ā   
call edx Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā   
ret 18Ā 

It uses NtWriteProcessMemory to copy the same shellcode onto that virtually allocated address. It usesĀ NtWriteProcessMemoryĀ to copy the same shellcode onto that virtually allocated address.ā€

Experts pointed out that GuLoader remains a dangerous threat that constantly evolves, they also shared Indicators of Compromise for the latest variant of the downloader.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

PierluigiĀ Paganini

(SecurityAffairsĀ ā€“ hacking, GuLoader)

The post GuLoader implements new evasion techniques appeared first on Security Affairs.