Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 18:08:31 UTC
Home > List all groups > List all tools > List all groups using tool GuLoader
 Tool: GuLoader
Names
GuLoader
vbdropper
CloudEyE
Category Malware
Type Loader
Description
(Proofpoint) Proofpoint researchers have observed a new downloader in the wild that we
and other researchers are calling “GuLoader.” Our researchers first observed GuLoader
in late December 2019 being used to deliver Parallax RAT, which itself had recently
been released. While we regularly observe new loaders, GuLoader has gained popularity
quickly and is in active use by multiple threat actors. GuLoader is a downloader, written
partly in VB6, which typically stores its encrypted payloads on Google Drive or
Microsoft OneDrive (underscoring that threat actors continue to adopt the cloud just like
legitimate businesses are).
GuLoader is a portable executable (PE) file that is often observed embedded in a
container file such as an .iso or .rar file. We have also observed it being downloaded
directly from various cloud hosting platforms. GuLoader is used predominantly to
download remote access Trojans (RATs) and information stealers such as Agent
Tesla/Origin Logger, Formbook, NanoCore RAT, NetWire RC, RemcosRAT, Ave
Maria/Warzone RAT and Parallax RAT.
Information https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=835729de-277b-4407-a4a6-4f6ad64b853f
Page 1 of 2

MITRE ATT&CK Malpedia
AlienVault OTX Last change to this tool card: 26 December 2024
Download this tool card in JSON format
All groups using tool GuLoader
Changed Name Country Observed
APT groups
 DarkCasino [Unknown] 2021
 RATicate [Unknown] 2019
2 groups listed (2 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=835729de-277b-4407-a4a6-4f6ad64b853f
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=835729de-277b-4407-a4a6-4f6ad64b853f
Page 2 of 2