Netskope Threat Coverage: GuLoader

Summary

GuLoader is a sophisticated malware downloader that stores its payloads in Google Drive and Microsoft OneDrive. In addition to using popular cloud apps to evade network-based detection, it uses anti-VM techniques to evade sandbox analysis.  

Threat

Since it was first discovered in December 2019, GuLoader has become one of the top malware delivery mechanisms observed in the wild. It is used by multiple threat actors to deliver a variety of threats, most commonly remote access Trojans (RATs). It uses eight different techniques to detect virtualization and evade sandbox analysis, including novel hook detection and RDTSC detection techniques.  

Reference: https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/research/playing-with-guloader-anti-vm-techniques-malware/ 

Scope

GuLoader is widely used by multiple threat actors to spread a variety of malware targeting Microsoft Windows endpoints.

Protection

Netskope Threat Labs is actively monitoring multiple malware campaigns using GuLoader and has ensured coverage for all known threat indicators and payloads.

Netskope’s Advanced Threat Protection includes multiple static analysis engines and a cloud sandbox, both of which can detect previously unseen malware samples that use GuLoader as they appear in the wild. The screenshot below shows the sandbox results for a GuLoader sample in the Netskope UI. This specific sample downloads its payload from Google Drive from the URL shown. The sandbox also identifies the anti-analysis features of GuLoader.

• Netskope Threat Protection
  • Gen:Variant.Razy.681950
  • Trojan.GenericKD.43600446
  • Gen:Variant.Razy.692938
  • Gen:Variant.Zusy.304654
  • Gen:Variant.Midie.74271
  • Gen:Variant.Graftor.808153
  • Trojan.GenericKD.43603672
  • Trojan.GenericKD.42854072
  • Trojan.GenericKD.34278163
  • Gen:Variant.Graftor.809267
  • And many more…
• Netskope Advanced Threat Protection provides proactive coverage against this threat using both our ML and heuristic-based static analysis engines and our cloud sandbox
  • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by Netskope’s cloud sandbox
  • Gen.Malware.Detect.By.StHeur indicates a sample that was detected by one of Netskope’s static analysis engines