Welcome to the April 2023 edition of our monthly malware analysis digest. <\/p>\n\n\n\n
ANY.RUN<\/a>\u2019s aim is to keep you up-to-date with the latest cybersecurity events and emerging threats that have surfaced over the past month. So let’s dive into the key highlights and developments in the world of malware and cybersecurity that occurred in April 2023.<\/p>\n\n\n\n GuLoader<\/a>, a notorious downloader used in email-based malware campaigns since 2019, has reemerged<\/a> in the wild. In the past, it has disguised itself as various attachments, including a health e-book sent from the World Health Organization. GuLoader is primarily used to deliver payloads for different campaigns, including data stealers, trojans, and other forms of malware. Its design allows it to evade network detection and bypass sandbox technology. <\/p>\n\n\n\n In a recent incident, a bogus shipping notification email written in Italian was identified as containing GuLoader. Unlike previous instances, GuLoader was not hidden inside a ZIP file. instead, it was found in an .ISO file disguised as a fake .JPG file with a double extension \u2014 an old trick that still proves effective.<\/p>\n\n\n\n\n1. GuLoader Resurfaces in Fake Shipping Notification Emails <\/h2>\n\n\n\n