Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

GuLoader: Malspam Campaign Installing Net Wire RAT

Summary: Unit 42 documented a March 2020 malspam chain in which an emailed link delivered a Microsoft Word document whose macro code retrieved a GuLoader executable, which then pulled an encrypted data file to install the NetWire RAT, a publicly available remote access tool in criminal use since 2012. GuLoader, first discovered in December 2019, made the initial executable persistent through a Windows Registry key and deleted the original from the user's AppData\Local\Temp directory, with NetWire artifacts also written to HKCU\Software\NetWire.

Why it matters: The researchers note that only a small percentage of infection attempts need to succeed for this distribution to stay cost-effective, and that binaries are updated and re-released after each wave is taken down - so the 24-hour takedown of the URLs serving this campaign is a temporary win, not a closed case.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related