CYBERSECURITYTRACKER
TRACKING6,506 stories in this site build1,309 vulnerability news stories in this site build
Permanent story citation

Technical Analysis of GuLoader Obfuscation Techniques

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 6264

As cited

Copy frozen at (site build).

threat intel

Technical Analysis of GuLoader Obfuscation Techniques

GuLoader is a malware downloader active since December 2019 that employs advanced obfuscation techniques including polymorphic code, exception-based control flow redirection, and encrypted strings to evade detection and complicate analysis. The malware has evolved over time, with 2024 versions introducing five distinct exception types and more complex address calculation methods to obscure execution flow. GuLoader primarily delivers remote access trojans (RATs) and information stealers hosted on legitimate cloud services like Google Drive and OneDrive.

Why it matters: Threat analysts and defenders need to understand GuLoader's evolving obfuscation tactics to identify and analyze samples, and security teams must monitor for payload downloads from trusted cloud platforms since the malware leverages their reputation for delivery.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

threat intel

Technical Analysis of GuLoader Obfuscation Techniques

GuLoader is a malware downloader active since December 2019 that employs advanced obfuscation techniques including polymorphic code, exception-based control flow redirection, and encrypted strings to evade detection and complicate analysis. The malware has evolved over time, with 2024 versions introducing five distinct exception types and more complex address calculation methods to obscure execution flow. GuLoader primarily delivers remote access trojans (RATs) and information stealers hosted on legitimate cloud services like Google Drive and OneDrive.

Why it matters: Threat analysts and defenders need to understand GuLoader's evolving obfuscation tactics to identify and analyze samples, and security teams must monitor for payload downloads from trusted cloud platforms since the malware leverages their reputation for delivery.

VendorsGoogleGitHub
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary