Live Stream VOD: Guloader NSIS Delivery Analysis (Patreon)

Published:

2022-12-20 05:23:04

Imported:

2023-09

Content

In this twitch stream we take a second look at Guloader with a focus on its highly obfuscated delivery chain. An NSIS loader is used to execute multiple layers of obfuscated PowerShell which eventually lead to the Guloader shell code.

The goal of this stream is to better understand the obfuscated NSIS delivery techniques used by Guloader and compare them to other iterations of their delivery chain with an aim to identify commonalities.

This stream ends up being just Part 1 as we don't get the final shell code fully extracted... stay tuned for Part 2!

Sample

54976a776a08ddd4ab7cf1fb6b00c4a23f931f1a7d1d937922169ef3be7c9cae

Notes

Guloader Delivery (PowerShell)

Files

overlay

This is "Live Stream VOD: Guloader NSIS Delivery Analysis" by OALABS on Vimeo, the home for high quality videos and the people who love them.