MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03341d9a4d9de7efc8928aa7fce88fa7cd157537e976b6db62b299c7b861a41d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03341d9a4d9de7efc8928aa7fce88fa7cd157537e976b6db62b299c7b861a41d
SHA3-384 hash: 81ca4b7f3554c25a8f4b27a441966df42854ff18bbc0b66f78ad138954f1c3816aa9522673a0a9239c57a6d2cc34cb38
SHA1 hash: 4cf3329cfd351a0eece02342b71068546ef50f63
MD5 hash: da30a43c86cc5e73d9dba2f388ddb579
humanhash: item-football-item-video
File name:awb_shipping_documents_26_03_2024_000000000.7z
Download: download sample
Signature GuLoader
Create hunting rule
File size:124'213 bytes
First seen:2024-03-26 14:48:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:dfpw8Phuya3ewRhGbI3SRrRfd9pKwzZ6POLabMCgIqmRgiarg00:xOjHc6Mr1d9o46kagCgIquz6gv
TLSH T113C3128818E8A26A40BB0C94D4C3495931BDF51674FDCAD7177B8284B708BFCE96BF12
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:7z DHL GuLoader INVOICE Shipping zip


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL International GmbH <ope@rikkyo.ac.jp>" (likely spoofed)
Received: "from s845300.srvape.com (s845300.srvape.com [188.127.227.194]) "
Date: "26 Mar 2024 04:15:47 -0700"
Subject: "Shipping invoice"
Attachment: "awb_shipping_documents_26_03_2024_000000000.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:awb_shipping_documents_26_03_2024_000000000.vbs
File size:243'328 bytes
SHA256 hash: 086fd488622c16461d2c60ca3cd42a7d5147978f1624e51a04c7ceedcaa71c6c
MD5 hash: c4610edd5f00bd7d8ea938515adaa32c
MIME type:text/plain
Signature GuLoader
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm masquerade
Link:
https://www.filescan.io/uploads/6602e065f7095ca3446cfe8b/reports/53ec41fd-b3c5-480f-93b3-094b1fec8e06/overview
Verdict:
Suspicious
Labled as:
Mal/DrodZp
Link:
https://www.hybrid-analysis.com/sample/03341d9a4d9de7efc8928aa7fce88fa7cd157537e976b6db62b299c7b861a41d
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/03341d9a4d9de7efc8928aa7fce88fa7cd157537e976b6db62b299c7b861a41d
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Score:
77%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/03341d9a4d9de7efc8928aa7fce88fa7cd157537e976b6db62b299c7b861a41d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03341d9a4d9de7efc8928aa7fce88fa7cd157537e976b6db62b299c7b861a41d/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2024-03-26 03:45:30 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
13 of 37 (35.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=am2b3gsntxt67sesrkt7z2epu7grk5jx5f3lnw3cwkm4podbuqoq._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader persistence
Link:
https://tria.ge/reports/240326-t4ss9sed27/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Blocklisted process makes network request
Guloader,Cloudeye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/03341d9a4d9de7efc8928aa7fce88fa7cd157537e976b6db62b299c7b861a41d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 03341d9a4d9de7efc8928aa7fce88fa7cd157537e976b6db62b299c7b861a41d

(this sample)

GuLoader

Visual Basic Script (vbs) vbs 086fd488622c16461d2c60ca3cd42a7d5147978f1624e51a04c7ceedcaa71c6c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 086fd488622c16461d2c60ca3cd42a7d5147978f1624e51a04c7ceedcaa71c6c
  
Dropping
GuLoader

Comments