MITRE ATT&CKsoftware (malware)
S0561 GuLoader
- Domain
- enterprise
- Platforms
- Windows
- Version
- 2.0
- Created
- 2021-01-11
Description
GuLoader is a file downloader that has been used since at least December 2019 to distribute a variety of remote administration tool (RAT) malware, including NETWIRE, Agent Tesla, NanoCore, FormBook, and Parallax RAT.
Related
Uses · MITRE ATT&CK (12)
- T1071.001 Web Protocols sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1497.001 System Checks sub-technique
- T1497.003 Time Based Checks sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055 Process Injection technique
- T1102 Web Service technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
References
- https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/ Unit 42 NETWIRE April 2020
- https://elis531989.medium.com/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4 Medium Eli Salem GuLoader April 2021