GuLoader (also CloudEyE) is a small shellcode-based Windows downloader known for aggressive anti-analysis and for fetching encrypted payloads from legitimate cloud services such as Google Drive. It is a commercial crypter and loader-as-a-service tied by researchers to the Italian firm CloudEyE, and it commonly delivers RATs and stealers like Agent Tesla, Remcos, FormBook and Vidar. MITRE ATT&CK tracks it as S0561.

GuLoader: The Crypter-as-a-Service That Hides Payloads in the Cloud

GuLoader is a small, shellcode-based downloader built around aggressive anti-analysis, used to fetch and decrypt a final-stage payload that is frequently hosted on legitimate public cloud services such as Google Drive, OneDrive and Dropbox. It is essentially a commercial crypter and delivery layer; researchers tied it to the Italian firm “CloudEyE,” earlier marketed as the “DarkEyE” crypter. It remains one of the most persistent commodity first-stage downloaders behind infostealer and RAT infections. MITRE ATT&CK tracks it as S0561.

Overview

GuLoader is a crypter and loader-as-a-service used by many unrelated operators. Per Malpedia it typically downloads RATs and stealers including Agent Tesla, Vidar, FormBook, Lokibot, NetWire and Remcos, commonly pulled XOR-encrypted from Google Drive. Check Point exposed the CloudEyE link in June 2020, when the firm advertised monthly tiers around $100, $200 and $750 and researchers estimated roughly $500,000 per month in criminal sales — a researcher estimate, not an audited figure.

How It Works

Shellcode delivery: a VBScript or dropper runs anti-analysis checks, then injects embedded shellcode that downloads and decrypts the final payload. T1106 T1055
Cloud-hosted payloads: the encrypted blob is pulled from Google Drive, OneDrive or Dropbox, so the download looks benign. T1105 T1071.001
Anti-analysis: scans process memory for VM strings, checks for debuggers and breakpoints and terminates if found, and uses redundant injection with inline assembly to bypass user-mode API hooks. T1497.001 T1497.003
Donor-process injection into a suspended legitimate process (MITRE notes RegAsm.exe as a donor), with RunOnce persistence and deletion of the dropper from %TEMP%. T1547.001 T1070.004

Delivery

GuLoader arrives through phishing emails carrying archive attachments or links to script downloaders, often with tax, invoice and business-themed lures, and has appeared in steganographic campaigns such as TA558’s SteganoAmor. T1566.002 T1204.002

MITRE ATT&CK Mapping (S0561)

Tactic	Technique	Usage
Command and Control	T1071.001 Web Protocols	Retrieve payload
Command and Control	T1105 Ingress Tool Transfer	Cloud-hosted blob
Defense Evasion	T1055 Process Injection	Shellcode into donor process
Defense Evasion	T1497.001 System Checks	VM-string memory scan
Defense Evasion	T1070.004 File Deletion	Removes dropper from %TEMP%
Persistence	T1547.001 Registry Run Keys	RunOnce

Detection & Mitigation

Inspect or constrain script execution (WScript, VBS); monitor injection into donor processes such as RegAsm.exe.
Alert on cloud-storage downloads of encrypted blobs by scripting or utility processes followed by in-memory decryption.
Email filtering for archive attachments and script-download links; EDR memory scanning and application control to limit abusable binaries.

Stop Loaders Before the Payload

Mjolnir Security helps organisations detect downloaders and the payloads they stage from the cloud.

Managed Detection & ResponseThreat HuntingEmail SecurityIncident ResponseEndpoint Hardening

Managed Detection and Response Monitoring for shellcode injection into donor processes and cloud-hosted encrypted downloads.
Email Security and Phishing Defense Attachment and script-link controls against downloader delivery.
24/7 Incident Response Containment before payload deployment. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026