Technical Analysis Details GuLoader’s Evolving Obfuscation Techniques
Summary
Zscaler researchers detail how GuLoader uses polymorphic code, exception-based control flow, encrypted strings, and cloud-hosted payloads to hinder analysis and evade detection, and describe scripts for deobfuscating samples.
Key points
- GuLoader is a downloader used to deliver RATs, information stealers, and other malware.
- Its polymorphic code dynamically constructs constants and strings, complicating static analysis and signature detection.
- Since 2022, GuLoader has expanded exception-based control-flow redirection, adding exception types and more complex jump-address calculations.
- The malware uses dynamic hashing and XOR-encrypted strings to conceal APIs, C2 domains, file paths, and other data.
- Payloads are downloaded from hardcoded URLs, often hosted on services such as Google Drive or OneDrive.
- ThreatLabz provides IDA scripts to calculate constants and strings and remove exception-based control-flow obfuscation; the article also lists sample hashes.
Article Details
- Attack Vectors
- GuLoader is distributed as a malware downloader and delivers secondary payloads, including RATs and information stealers, to compromised systems.
- GuLoader payloads are downloaded from hardcoded URLs that may point to shared files on Google Drive or OneDrive.
- GuLoader uses polymorphic code to construct constants and strings dynamically, and deliberate CPU exceptions with a custom handler to redirect control flow and hinder analysis.
- GuLoader encrypts strings, including C2 domains and file paths, with XOR; its payload decryption uses an XOR key held in an encrypted binary buffer.
- Defensive Notes
- ThreatLabz developed IDA scripts to calculate GuLoader constants and strings and remove exception-based control-flow obfuscation for analysis.
- The article says emulation is one of the best approaches to recover strings dynamically constructed by GuLoader.
- Zscaler reports detecting GuLoader-related indicators through its cloud security platform and Cloud Sandbox.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0bcc5819a83a3ad0257a4fe232e7727d2f3d04e6f74c6d0b9e4dfe387af58067 | GuLoader sample hash listed as an IOC; version 2023. |
| SHA256 | 274329db2d871d43eed704af632101c6939227d36f4a04229e14603f72be9303 | GuLoader sample hash listed as an IOC; version 2022. |
| SHA256 | 4be24d314fc9b2c9f8dbae1c185e2214db0522dcc480ba140657b635745e997b | GuLoader sample hash listed as an IOC; version 2023. |
| SHA256 | 53bad49e755725c8d041dfaa326e705a221cd9ac3ec99292e441decd719b501d | GuLoader sample hash listed as an IOC; version 2024. |
| SHA256 | 7fccb9545a51bb6d40e9c78bf9bc51dc2d2a78a27b81bf1c077eaf405cbba6e9 | GuLoader sample hash listed as an IOC; version 2024. |
| SHA256 | 90de01c5ff417f23d7327aed517ff7f285e02dfe5dad475d7f13aced410f1b95 | GuLoader sample hash listed as an IOC; version 2022. |
Malware
Vendors
Products
Google DriveThe threat actors that distribute GuLoader often host malware on legitimate platforms including Google Drive and OneDrive to evade reputation-based detection.IDA ProThreatLabz developed IDA scripts, available in the ThreatLabz GitHub repository, to decrypt the static encrypted strings found in GuLoader samples from 2022.Microsoft OneDriveactors that distribute GuLoader often host malware on legitimate platforms including Google Drive and OneDrive to evade reputation-based detection.Zscaler Cloud SandboxZscaler’s multilayered cloud security platform detects indicators related to GuLoader at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for GuLoader.