Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Tackling Anti-Analysis Techniques of GuLoader and Red Line Stealer

Summary: Unit 42 researchers described how GuLoader's authors evolved their obfuscation to defeat the team's prior configuration-extraction approach, splitting ciphertext into 4-byte DWORDs encrypted with randomized mathematical operations and adding control flow obfuscation. They also detailed extracting RedLine Stealer's configuration from a sample with SHA256 hash a4cf69f849e9ea0ab4eba1cdc1ef2a973591bc7bb55901fdbceb412fb1147ef9, using dnSpy and the dnfile library to resolve .NET string tokens.

What you should know: A GuLoader sample in early 2023 had zero VirusTotal detections and carried anti-analysis instructions that broke Unit 42's own IDA processor module extension, forcing manual analysis - a reminder that the tooling defenders rely on can be deliberately invalidated by the adversary.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related