Guloader Shellcode

GuLoader shellcode is a type of malware that utilizes various techniques to infiltrate systems, disrupt operations, and potentially steal personal information. The malicious software has been observed in encrypted forms such as the GuLoader VBScript and NSIS, both identified with unique MD5 hashes. These scripts contain XOR encoded strings responsible for downloading the GuLoader shellcode. The malware also deploys payloads like Remcos, which have been found encrypted and decrypted with distinct MD5 identifiers. Despite being uploaded to VirusTotal (VT) three weeks prior to this report, the URLs for downloading both the GuLoader shellcode and the Remcos payload remain active. The GuLoader shellcode has been extensively analyzed in previous research, with a focus on its evolution and cloud-based delivery mechanisms. It has been noted that the malware uses GitHub to stage or distribute malicious files. This was evidenced in several instances reported by Qualys, Morphisec Labs, and independent security researcher 0xToxin throughout 2023. These cases involved the use of Excel spreadsheets, PowerShell scripts, and phishing campaigns to deliver the GuLoader shellcode, highlighting the versatility of this malware's distribution methods. Starting from late 2022, the GuLoader shellcode began employing a new anti-analysis technique. This method involves disrupting the normal flow of code execution by intentionally triggering a large number of exceptions. These exceptions are then managed in a vector exception handler that redirects control to a dynamically calculated address. This innovative approach further complicates the process of analyzing and mitigating the threat posed by the GuLoader shellcode, necessitating ongoing vigilance and sophisticated countermeasures from cybersecurity professionals.