GuLoader

GuLoader is a Windows shellcode-based downloader and loader that has been active since at least 2019 and is widely used in commodity malware delivery operations. It is commonly associated with the delivery of Agent Tesla, FormBook, NetWire, NanoCore, Parallax RAT, Remcos, LokiBot, XLoader, XWorm, VIPKeylogger, and Snake Keylogger/404 Keylogger. GuLoader is frequently wrapped in NSIS installers, VB-based launchers, or VBScript and PowerShell stages, and it is notable for decrypting and executing payloads directly in memory rather than writing final-stage malware to disk. Public cloud and other legitimate web services have repeatedly been abused to host encrypted GuLoader shellcode or downstream payloads.

The malware emphasizes defense evasion and anti-analysis. GuLoader dynamically resolves APIs through hashing, encrypts strings and payloads with XOR-based schemes, and heavily obfuscates control flow. A defining feature of newer variants is exception-driven execution flow using vectored exception handlers. Instead of ordinary branching, GuLoader deliberately triggers breakpoint, single-step, access-violation, and in later variants illegal-instruction and privileged-instruction exceptions, then computes the next execution address inside the handler. This design complicates static analysis, debugging, and signature generation. Additional anti-analysis behavior includes anti-debugging checks, hardware- and software-breakpoint detection, debugger hiding, timing checks, virtualization and sandbox detection, and inspection of system artifacts associated with analysis environments.

GuLoader also supports process injection. Observed variants create a legitimate Windows process in a suspended state and inject shellcode into it before resuming execution; RegAsm has been documented as one donor process. Later shellcode stages then perform network retrieval of encrypted payloads and execute them in memory. This architecture allows GuLoader to function as a flexible malware delivery platform rather than a final payload itself.

Distribution has been observed through phishing and spearphishing campaigns, including malicious Office documents with embedded macros, archive-based lures, NSIS-packaged executables, and job-, invoice-, tax-, shipping-, and order-themed social engineering. More recent activity has also tied GuLoader to web-based fake CAPTCHA and ClickFix-style chains that trick users into launching trusted Windows binaries to load remote content in memory. Financially motivated operators and intrusion clusters have used GuLoader in campaigns targeting businesses across multiple sectors, including banking and other enterprises, with notable reporting on activity affecting African financial institutions and Italian businesses.