GuLoader Demystified: The Shellcode Smuggler Behind Mass Campaigns

Threat Intelligence

GuLoader (sold as CloudEyE) has delivered more malware families than almost any other loader by hiding shellcode in encrypted blobs on Google Drive, OneDrive, and Discord. Its NSIS and VirtualAlloc tricks confound most sandboxes.

By Arjun Raghavan, Security & Systems Lead, BIPI · September 14, 2024 · 9 min read

GuLoader, discovered in 2019 and sold commercially as CloudEyE by its Italian developers, occupies an unusual position in the malware ecosystem: it is a loader that has been used to deliver almost every major info-stealer and RAT family, including AgentTesla, Remcos, NanoCore, Formbook, and AveMaria. Its value proposition is not capabilities but evasion: it gets other malware past endpoint defenses with a reliability that pure-play RAT operators cannot match on their own.

NSIS-Based Delivery

Most GuLoader samples arrive as NSIS (Nullsoft Scriptable Install System) executables. NSIS is a legitimate open-source installer framework used by thousands of genuine software products. Antivirus engines are trained to be permissive with NSIS binaries because flagging them would produce enormous false-positive volumes. GuLoader exploits this trust by packaging its shellcode loader inside an NSIS installer that, when executed, extracts a Visual Basic Script or PowerShell dropper from an encrypted cabinet inside the NSIS archive.

• Outer container: NSIS .exe, legitimate file format, low AV detection rate
• Extracted component: VBScript or PowerShell with heavy string obfuscation
• Script function: download encrypted shellcode blob from cloud storage URL
• Cloud storage used: Google Drive, OneDrive, Dropbox, Discord CDN (all trusted, often not inspected by proxy)
• Final stage: shellcode blob decrypted in memory and injected into a legitimate process

VirtualAlloc Obfuscation

GuLoader's shellcode loader uses a series of API calls that are individually legitimate but collectively constitute shellcode injection. The loader calls VirtualAlloc to reserve memory with PAGE_EXECUTE_READWRITE permissions, decrypts the shellcode blob using XOR or RC4 with a key derived from the process environment, copies the decrypted shellcode into the allocated region, and then uses a jmp instruction to transfer execution. The key innovation is that GuLoader generates unique shellcode decryption routines for each build using a metamorphic engine, meaning static signatures on the shellcode itself are ineffective.

Because the shellcode decryption key is derived from process environment variables at runtime, the same GuLoader sample will fail to decrypt on a machine with a different hostname, user SID, or system locale. This environment binding defeats cloud sandbox analysis unless the sandbox replicates the victim environment exactly.

Anti-Analysis Techniques

1. CPUID checks: verifies physical CPU core count (sandboxes often report 1-2 cores; real machines typically have 4+)
2. Timing attacks: calls GetTickCount before and after a busy-wait loop; if the elapsed time is wrong, sandbox is assumed
3. Debugger detection: checks NtGlobalFlag and IsDebuggerPresent, and also uses hardware breakpoint detection via SEH
4. Environment binding: derives decryption key from machine-specific values, causing decryption to fail in mismatched environments
5. API hashing: resolves Windows API functions by hash rather than name, defeating string-based detection
6. Direct syscalls: bypasses user-mode hooks by calling NT system call numbers directly with inline assembly

CloudEyE: The Legitimate Cover

GuLoader's developers market the tool as CloudEyE, a 'legitimate' software protection and distribution service. Their website advertises it as a way to protect intellectual property and distribute software via cloud storage. This creates a legal gray area: the developers have plausible deniability, and because CloudEyE is sold as a service, malware analysts cannot simply arrest the developers for writing code. Law enforcement has investigated but as of late 2023 the developers remain operational.

Detection

• Alert on VirtualAlloc calls with PAGE_EXECUTE_READWRITE followed by execution from that memory region (ETW-based detection or EDR telemetry)
• Process: NSIS installer processes (with NSIS parent) spawning wscript.exe, powershell.exe, or mshta.exe are anomalous
• Network: HTTP GET requests to google.com/uc?export=download or 1drv.ms from non-browser processes
• Sysmon EventID 8 (CreateRemoteThread) into a new process from an NSIS or script host process
• PowerShell Script Block Logging will capture the deobfuscated download URL and shellcode blob reference

Remediation

1. Enable TLS inspection for cloud storage domains (Google Drive, OneDrive, Dropbox) in your web proxy
2. Block file downloads from cloud storage domains to non-browser user-agent strings at the proxy layer
3. Enable ETW-based memory execution tracing in your EDR; alert on execute-from-heap patterns
4. Implement Script Block Logging for PowerShell and capture VBScript execution via Windows Script Host audit policy
5. Block NSIS installers via software restriction policy unless they are signed by a trusted publisher certificate in your allowlist

Read more field notes, explore our services, or get in touch at info@bipi.in. Privacy Policy · Terms.