GuLoader Targets US Financial Firms With Tax-Themed Phishing Lures

A malware loader known as GuLoader has been observed focusing on the US fiscal sector applying phishing email messages with a tax-themed lure.

Security scientists at eSentire shared the findings in an advisory posted on Monday.

“GuLoader, also regarded as CloudEyE, is a loader malware that is regarded to provide additional malware, these types of as infostealers and Distant Accessibility Trojans (RATs),” wrote eSentire’s Risk Reaction Device (TRU).

“The loader includes several stages of shellcode and is regarded for being one particular of the most state-of-the-art loaders with a lot of anti-analysis tactics.”

The strategies focusing on US economic companies had been observed by the TRU in March 2022.

“The phishing email contained a shared url to Adobe Acrobat, the place the person could obtain the password-shielded ZIP archive,” reads the advisory. 

The ZIP archive, in switch, consists of a decoy graphic and a shortcut file disguised as a PDF. The latter relies on PowerShell to down load added payloads from the internet site.

“GuLoader achieves persistence by way of Registry Operate Keys,” eSentire wrote. “The ‘State’ registry essential includes the obfuscated PowerShell script that reflectively hundreds the GuLoader shellcode in memory.”

In accordance to the workforce, the malware loader is indicative of the fact that tax-themed phishing lures are a well-known tactic applied by cybercriminals for the duration of tax time.

“These lures generally acquire the form of phony e-mails that look to be from respectable tax authorities, this sort of as the IRS, and often consist of urgent messages about tax refunds or payments,” reads the advisory.

“Once the malware is put in, attackers can obtain the victim’s procedure and details, making it possible for them to carry out further more attacks.”

Read through more on cons like this in this article: IRS Phishing Email messages Utilized to Distribute Emotet

Further more, eSentire described that password-shielded ZIP archives are frequently an productive way to bypass email filters and antivirus courses.

“By compressing a file into a password-guarded archive, the file gets more tough for antiviruses and email filters to scan and analyze because they can not scan the contents of the archive without the need of the proper password.”

Yet another malware marketing campaign relying on ZIP archives was a short while ago attributed to risk actors who employed them to deploy the MortalKombat ransomware.

Some components of this report are sourced from:
www.infosecurity-journal.com