CloudEyEMalware
- GuLoader
- vbdropper
CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.From MISP Galaxy
Last reported 7 months ago, by ESET WeLiveSecurity (ES)5 reports
ATT&CK techniques
6 of 59 · each with the sentence it comes from- T1055Process Injection
“T1055.012 Process Injection: Process Hollowing”
- T1027Obfuscated Files or Information
“T1027.001 Obfuscated Files or Information: Binary Padding”
- T1027.001Binary Padding
“T1027.001 Obfuscated Files or Information: Binary Padding”
- T1027.002Software Packing
“T1027.002 Obfuscated Files or Information: Software Packing”
- T1027.003Steganography
“T1027.003 Obfuscated Files or Information: Steganography”
- T1027.007Dynamic API Resolution
“T1027.007 Obfuscated Files or Information: Dynamic API Resolution”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Panorama infostealer: cambios globales y casos destacados en México y Brasil“…gentTesla: A pesar de su declive en desarrollo, sigue siendo un "peso pesado" distribuido ampliamente a través de servicios como CloudEyE.”
-
Technical Analysis of GuLoader Obfuscation Techniques“Technical Analysis of GuLoader Obfuscation Techniques”
-
ESET Threat Report H2 2025“Meanwhile, CloudEyE, also known as GuLoader, surged into prominence, skyrocketing almost thirtyfold in ESET telemetry.”
-
Getting gooey with GULOADER: deobfuscating the downloader“Elastic Security Labs continues to monitor active threats such as GULOADER, also known as CloudEyE – an evasive shellcode downloader that has been highly active for years while under constant development.”
-
Traders’ dollars in danger: CVE-2023-38831 zero-day vulnerability in WinRAR exploited by cybercriminals to target traders“A ZIP archive was crafted to deliver various malware families: DarkMe, GuLoader, Remcos RAT”
Indicators in its reports
named in the reports above- 90de01c5ff417f23…aced410f1b95in 1 report
- 274329db2d871d43…603f72be9303in 1 report
- 4be24d314fc9b2c9…b635745e997bin 1 report
- 0bcc5819a83a3ad0…fe387af58067in 1 report
- 7fccb9545a51bb6d…af405cbba6e9in 1 report
- 53bad49e755725c8…decd719b501din 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.