Warning Against Phishing Emails Distributing GuLoader Malware by Impersonating a Famous International Shipping Company

AhnLab ASEC observed a phishing campaign impersonating an international shipping company that delivered GuLoader via a malicious attachment; the attachment contains an obfuscated VBScript that executes an embedded PowerShell to download additional files, create a persistence registry key under HKCU\SOFTWARE\[Random Name] (sample: PolySyndetic), and finally inject and execute Xworm RAT via msiexec.exe. The report provides MD5 hashes, download URLs (e.g., https://planachiever.au/admin-admin/Belejrers.fla), and a C2 FQDN (tripplebanks.duckdns.org) as IOCs and warns that GuLoader, as a downloader, may cause secondary infections.