🦠 ThreatLabz has identified an x64 variant of GuLoader. The sample uses similar anti-analysis methods as GuLoader x86 samples. However, the following anti-analysis features have been added:
- Huge stack frames in order to break IDA's decompilation.
- Direct syscalls to call Windows native API functions. GuLoader chooses a different syscall address that is chosen randomly.
- The registered Vectored Exception Handler (used to obfuscate the control flow) points to a location within NTDLL's memory region, making the exception-driven control flow appear legitimate.
- Use of the Windows API function TrySubmitThreadpoolCallback to execute callbacks and avoid detection.
Sample hash: dc5021a0e1d00fb1da9eef2b5d5ac3f9a5906e5c3c17470807c3845083ac5a6d
Malicious Google Drive URL: hxxps://drive.google[.]com/uc?export=download&id=1Zynj-CzTxaYpQr5aniRGE5gUqs26k-t5