As cited
Copy frozen at (site build).
threat intel
Technical Analysis of GuLoader Obfuscation Techniques
GuLoader is a malware downloader active since December 2019 that employs advanced obfuscation techniques including polymorphic code, exception-based control flow redirection, and encrypted strings to evade detection and complicate analysis. The malware has evolved over time, with 2024 versions introducing five distinct exception types and more complex address calculation methods to obscure execution flow. GuLoader primarily delivers remote access trojans (RATs) and information stealers hosted on legitimate cloud services like Google Drive and OneDrive.
Why it matters: Threat analysts and defenders need to understand GuLoader's evolving obfuscation tactics to identify and analyze samples, and security teams must monitor for payload downloads from trusted cloud platforms since the malware leverages their reputation for delivery.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Technical Analysis of GuLoader Obfuscation Techniques
GuLoader is a malware downloader active since December 2019 that employs advanced obfuscation techniques including polymorphic code, exception-based control flow redirection, and encrypted strings to evade detection and complicate analysis. The malware has evolved over time, with 2024 versions introducing five distinct exception types and more complex address calculation methods to obscure execution flow. GuLoader primarily delivers remote access trojans (RATs) and information stealers hosted on legitimate cloud services like Google Drive and OneDrive.
Why it matters: Threat analysts and defenders need to understand GuLoader's evolving obfuscation tactics to identify and analyze samples, and security teams must monitor for payload downloads from trusted cloud platforms since the malware leverages their reputation for delivery.
- Source published
- First seen by Cybersecurity Tracker