Presentation information

GuLoader? No, CloudEyE. Flattening the attack curve of the top malicious dropper
FREE REGISTRATION

GuLoader? No, CloudEyE. Flattening the attack curve of the top malicious dropper

Alexey Bukhteyev (Check Point Software Technologies) & Arie Olshtein (Check Point Software Technologies)
partner message

ANY.RUN - Interactive malware analysis sandbox

http://any.run/

Get fast results in real-time! Intuitive interface. Convenient for any level analysts.

Join for free and start your malware hunting!

partner message

Avira Cloud Sandbox API. Completely private, unlimited-scale, automated malware analysis service

https://oem.avira.com/en/solutions/cloud-sandbox-api

Avira’s Cloud Sandbox API is built to ensure data privacy.

Receive detailed, file-specific threat intelligence reports containing actionable intelligence.

Supports MITRE ATT&CK™ framework.

partner message

Do APT Mercenary Groups Pose Real Threat to Companies?

https://businessresources.bitdefender.com/apt-as-a-service-webinar

Learn about the recent Bitdefender investigation of a new attack attributed to a sophisticated actor offering advanced-persistent-threats-as-a-service.

Access the investigation

partner message

Be a part of the cyber resilience story - explore careers at

https://careers.opentext.com/

Join the cybersecurity and data protection team at Carbonite + Webroot, OpenText companies.

partner message

We don’t just talk about sharing. We do it every day

https://www.cyberthreatalliance.org/our-sharing-model/

Find out more about how threat intelligence sharing and collaboration through the Cyber Threat Alliance can function as a force multiplier to improve defenses across the ecosystem.

partner message

Map Malicious Infrastructures with Pure Signal™ Intelligence

https://partners.team-cymru.com/pure-signal-trial

Elite analyst teams use Team Cymru’s Pure Signal platform to access 50+ data types, including global network flow, PDNS, malware and more.

Start your 2-week trial now!

partner message

What is cyber threat intelligence (CTI) and how is it used?

Join the VB2020 Threat Intelligence Practitioners’ Summit (TIPS)

Join the VB2020 Threat Intelligence Practitioners’ Summit, sponsored by the Cyber Threat Alliance,

to hear from leading industry voices on how CTI sharing can function as a force multiplier to strengthen defenses across the ecosystem.

partner message

Kaspersky Threat Intelligence Portal - find cyberthreats in files, URLs, IPs and domains

https://opentip.kaspersky.com/

Know which alerts or incidents pose real threats, and prioritize them fast and effectively based on impact and risk levels.

partner message

No-Cost Threat Detection for ISPs and Hosting Providers

https://partners.team-cymru.com/nimbus-threat-monitor

Partner with Team Cymru and get near-real-time threat detection, powered by our world-class IP Reputation data.

Join us now!

partner message

Outsource your Unwanted Software/PUA Work for Free

https://appesteem.com/avs

AppEsteem’s feeds sort out the good apps from the Deceptors.

Our criteria are widely accepted. We’ll help with your disputes.

All for Free. Giving you more time to fight real malware.

partner message

Do you want to know how IT security products score in independent tests?

https://www.av-comparatives.org/enterprise/latest-tests/

AV-Comparatives is an ISO certified independent organization offering systematic testing that checks whether security software lives up to its promises.

Results are available for free!

partner message

Defeating Application Fraud - Learn How

https://www.shapesecurity.com/solutions

We protect more accounts from fraud than everyone else in the world combined.

Shape Security is now part of F5 (www.f5.com)

partner message

30+ years of experience in the anti-malware industry

www.virusbulletin.com

Virus Bulletin is so much more than just a great conference.

Check out our website to see what more we have to offer.

partner message

DNSDB®: The DNS Super Power for Security Teams

https://www.farsightsecurity.com/get-started-guide/

Farsight Security DNSDB®: the world's largest real-time and historical database of DNS resolutions.

Get your free DNSDB API key and use it in our newly updated web GUI, DNSDB Scout and your own environments.

Contextualize everything DNS related with one API key - DNSDB.

partner message

Tired of home office and in urgent need of some networking?

https://www.amtso.org/newsletter/

Join the AMTSO community and meet security vendors, testers, journalists, and researchers to discuss cybersecurity trends, tests and standards!

Downloads

In this talk we will share our latest research work, in which we uncovered the service and identities behind GuLoader, the most prominent dropper used in 2020 to deliver malware with help of cloud drives, and how our publication led to flattening the GuLoader attack curve.

In our presentation we will show the full proof of the direct connection between the GuLoader malware and the CloudEyE protector, the supposedly legitimate product of a small Italian company.

We will present the identities of CloudEyE's operators, who made an estimated $500,000 selling their product to malicious actors. We demonstrate some of the CloudEyE evasion methods which make it a popular choice to deliver malware.

You will get acquainted with the GuLoader internal structure and the methods we used in our research. Immediately after CloudEyE's exposure, CloudEyE announced on its website the suspension of its service. As a result, our telemetry showed a dramatic decrease in the appearance of new GuLoader samples carrying malicious payloads. Later on, CloudEyE's operators contacted us and tried to justify their business, presenting themselves as a legitimate company helping small to medium-sized software developer groups who need protection for their code.

Our response to CloudEyE's protests of their innocence was to perform an experiment, in which we collected more than 5,000 GuLoader samples from VirusTotal and checked the delivered payloads for every one of them. In our presentation we show the detailed statistics on malicious and benign samples delivered with the help of CloudEyE. Together with advertisements that we found on hacking forums, this will help us to find the answer to our main question: did the CloudEyE operators know that their product was generally used by cybercriminals?
Alexey Bukhteyev
Check Point Software Technologies Alexey is a malware reverse engineer at Check Point Software Technologies. He specializes in malware research automation, Windows kernel mode development and macOS emulation. He also researches inside malware with the help of disassemblers, debuggers, and other tools. His final goal is to say what a researched piece of malware does and how it does it.
Arie Olshtein
Check Point Software Technologies Arie is a malware analyst at Check Point Software Technologies. On a daily basis, he monitors thousands of suspicious files, performing a quick analysis with the help of sandbox emulation, to identify suspicious campaigns and unique malware. He also writes Yara rules and behaviour signatures to detect new threats.
arrow left Back

GuLoader? No, CloudEyE. Flattening the attack curve of the top malicious dropper

Alexey Bukhteyev (Check Point Software Technologies) & Arie Olshtein (Check Point Software Technologies)
In this talk we will share our latest research work, in which we uncovered the service and identities behind GuLoader, the most prominent dropper used in 2020 to deliver malware with help of cloud drives, and how our publication led to flattening the GuLoader attack curve.

In our presentation we will show the full proof of the direct connection between the GuLoader malware and the CloudEyE protector, the supposedly legitimate product of a small Italian company.

We will present the identities of CloudEyE's operators, who made an estimated $500,000 selling their product to malicious actors. We demonstrate some of the CloudEyE evasion methods which make it a popular choice to deliver malware.

You will get acquainted with the GuLoader internal structure and the methods we used in our research. Immediately after CloudEyE's exposure, CloudEyE announced on its website the suspension of its service. As a result, our telemetry showed a dramatic decrease in the appearance of new GuLoader samples carrying malicious payloads. Later on, CloudEyE's operators contacted us and tried to justify their business, presenting themselves as a legitimate company helping small to medium-sized software developer groups who need protection for their code.

Our response to CloudEyE's protests of their innocence was to perform an experiment, in which we collected more than 5,000 GuLoader samples from VirusTotal and checked the delivered payloads for every one of them. In our presentation we show the detailed statistics on malicious and benign samples delivered with the help of CloudEyE. Together with advertisements that we found on hacking forums, this will help us to find the answer to our main question: did the CloudEyE operators know that their product was generally used by cybercriminals?
Alexey Bukhteyev
Check Point Software Technologies Alexey is a malware reverse engineer at Check Point Software Technologies. He specializes in malware research automation, Windows kernel mode development and macOS emulation. He also researches inside malware with the help of disassemblers, debuggers, and other tools. His final goal is to say what a researched piece of malware does and how it does it.
Arie Olshtein
Check Point Software Technologies Arie is a malware analyst at Check Point Software Technologies. On a daily basis, he monitors thousands of suspicious files, performing a quick analysis with the help of sandbox emulation, to identify suspicious campaigns and unique malware. He also writes Yara rules and behaviour signatures to detect new threats.