Friday, March 1, 2024

GuLoader Malware is Attacking Law Firms Using Weaponized PDF File

The cybersecurity researchers at Morphisec Labs have been tracking the GuLoader campaign since April of this year and found that it has been actively targeting the law firms that are based in the US along with several other sectors like:-

  • Healthcare
  • Investment firms
Targeted sectors (Source – Morphisec)

For more than three years, GuLoader (aka ‘Cloudeye’) has been active, still keeps evolving, and employs diverse anti-analysis methods, posing challenges to security analysts to analyze it.

GuLoader, infamous for distributing multiple malware families, such as:-

  • NetWire
  • Lokibot
  • Xloader
  • Remcos

The GuLoader downloads the payload by using trusted platforms like:-

  • Google Drive
  • OneDrive
  • GCloud

In this campaign, the operators of GuLoader used ‘’ as the download source to deliver the Remcos RAT (remote access trojan).

GuLoader Malware Infection Chain

Encrypted PDF attachment comes with a PIN provided in the email for decryption, luring the victim to click on an embedded icon and initiate the process.

Encrypted PDF (Source – Morphisec)

Once the icon is clicked, it redirects users to the final URL through Google’s popular adclick service, DoubleClick, extensively utilized in online ads for tracking and gathering statistics and metadata on user clicks.

Download page for GuLoader VBScript secured with password (Source – Morphisec)

The threat actors likely use it to assess their malicious campaign’s effectiveness. The user is prompted to enter the previously sent PIN in the redirected URL, and upon providing the PIN, a GuLoader VBScript is downloaded to proceed further.

The GuLoader VBScript contains obfuscation, random comments, and redundant lines omitted. Here, the resulting code decodes and a Powershell script is executed.

Infection chain (Source – Morphisec)

Using the 32-bit version of Powershell, the Powershell script decodes and runs a 2nd stage Powershell script. This 2nd stage script contains XOR-encoded strings, which are responsible for downloading the GuLoader shellcode due to the presence of logical code.

Here the GuLoader shellcode is split into two parts which are fetched from  ‘’ and here they are mentioned below:-

  • Decrypting shellcode
  • Encrypted shellcode

Later it’s invoked with encrypted shellcode and ‘NtProtectVirtualMemory’ as arguments by passing it as a callback function to ‘CallWindowProcA’. The core role of the shellcode is to inject the final payload into ‘ieinstal.exe’ process by downloading and decrypting it. 

Moreover, it also fetches and opens a malicious PDF that triggers and runs the Remcos RAT in the background and presents a “404 Page not found” error.

Page not found error (Source – Morphisec)

In phishing campaigns, GuLoader frequently emerges as a malware loader. Among the most advanced downloaders, it fetches payloads from cloud hosting platforms, and surprisingly, this campaign used a regular URL.

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.


Latest articles

Golden Corral restaurant chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...

Hackers Hijack Anycubic 3D Printers to Display Warning Messages

Anycubic 3D printer owners have been caught off guard by a series of unauthorized...

RSM US Deploys Stellar Cyber Open XDR Platform to Secure Clients

Stellar Cyber, the innovator of Open XDR, today announced that RSM US – the leading provider...

Biden Crack Down Sale of Americans’ Personal Data to China & Russia

To safeguard the privacy and security of American citizens, President Joe Biden has issued...

Kali Linux 2024.1 Released – What’s New

Kali Linux recently released version 2024.1, the first release of the year 2024, with...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles