Industrial companies in Europe targeted with GuLoader

Share:

A recent spear-phishing campaign targeting industrial and engineering companies in Europe was aimed at saddling victims with the popular GuLoader downloader and, ultimately, a remote access trojan that would permit attackers to steal information from and access compromised computers whenever they wish.

The emails are sent from various email addresses including from fake companies and compromised accounts. The emails typically hijack an existing email thread or request information about an order,” Tara Gould, Threat Research Lead at Cado Security, has warned.

The malware

The goal of the email is to make the recipient download the attachment – an .iso.7z.gzip or .rar archive file – and unpack it. In it is a batch file that contains an obfuscated PowerShell script.

Running the file starts a process of downloading another file containing a second PowerShell script which includes functionality to allocate memory via VirtualAlloc (a native Windows API function) and to execute shellcode.

“The second shellcode is injected into the legitimate ‘msiexec.exe’ process and appears to be reaching out to a domain to retrieve an additional payload, however at the time of analysis this request returns a 404. Based on previous research of GuLoader, the final payload is usually a RAT including Remcos, NetWire, and AgentTesla,” Gould shared.

The second script also creates a registry key for persistence.

Evasion and obfuscation is critical for GuLoader

“Guloader makes use of process injection to evade detection. This allows malicious code to be run through a legitimate process, meaning security products may not detect the malware, or victims may not be alerted since the process will look like a normal Windows process,” Gould told Help Net Security.

“The obfuscation methods are custom and deployed to bypass security products that may detect the files if they were not obfuscated and make analyzing the files more difficult.”

The evasiveness of the loader means that the threat actors deploying it can use a variety of final payloads without having to customize each one for evading detection.

“The anti-analysis techniques employed, including use of junk code and encrypted shellcode make analysis more difficult, which in turn makes creating detections more challenging. Additionally, as it is designed to disrupt analysis, more time is spent for security staff to determine what is occurring,” Gould concluded.

The targets

Cado Security has provided indicators of compromise and Yara rules to help organizations search for evidence of compromise.

The company says that the spear-phishing campaign targeted employees at electronic manufacturing, engineering and industrial companies in European countries: Romania, Poland, Germany and Kazakhstan.

Zeljka Zorz

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
3:37 am, Jul 8, 2025
weather icon 14°C
L: 13° | H: 15°
few clouds
Humidity: 74 %
Pressure: 1014 mb
Wind: 6 mph W
Wind Gust: 8 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 24%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:53 am
Sunset: 9:17 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
13° | 15°°C 1 mm 100% 11 mph 76 % 1019 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
15° | 25°°C 0.13 mm 13% 7 mph 59 % 1022 mb 0 mm/h
Thu Jul 10 10:00 pm
weather icon
18° | 30°°C 0 mm 0% 8 mph 72 % 1023 mb 0 mm/h
Fri Jul 11 10:00 pm
weather icon
19° | 30°°C 0 mm 0% 10 mph 66 % 1022 mb 0 mm/h
Sat Jul 12 10:00 pm
weather icon
18° | 29°°C 0 mm 0% 11 mph 74 % 1020 mb 0 mm/h
Today 4:00 am
weather icon
12° | 14°°C 1 mm 100% 11 mph 74 % 1015 mb 0 mm/h
Today 7:00 am
weather icon
13° | 13°°C 0.64 mm 64% 9 mph 76 % 1015 mb 0 mm/h
Today 10:00 am
weather icon
17° | 18°°C 0 mm 0% 9 mph 56 % 1017 mb 0 mm/h
Today 1:00 pm
weather icon
20° | 20°°C 0 mm 0% 7 mph 34 % 1018 mb 0 mm/h
Today 4:00 pm
weather icon
24° | 24°°C 0 mm 0% 7 mph 29 % 1017 mb 0 mm/h
Today 7:00 pm
weather icon
21° | 21°°C 0 mm 0% 7 mph 29 % 1018 mb 0 mm/h
Today 10:00 pm
weather icon
20° | 20°°C 0 mm 0% 4 mph 41 % 1019 mb 0 mm/h
Tomorrow 1:00 am
weather icon
17° | 17°°C 0 mm 0% 5 mph 48 % 1020 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€91,868.44
-1.51%
Ethereum(ETH)
€2,159.58
-1.78%
Tether(USDT)
€0.85
-0.01%
XRP(XRP)
€1.93
-0.66%
Solana(SOL)
€127.00
-2.17%
USDC(USDC)
€0.85
0.01%
Dogecoin(DOGE)
€0.142225
-3.61%
Shiba Inu(SHIB)
€0.000010
-2.33%
Pepe(PEPE)
€0.000009
-3.19%
Scroll to Top