MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03c0b10be2c560acd4c9772a9fb19c271ee143592ec316c580a3b4a6e433a219. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03c0b10be2c560acd4c9772a9fb19c271ee143592ec316c580a3b4a6e433a219
SHA3-384 hash: 0828455f4c464dd671849a527f1b48ed6bce4fda5bf46e180ed51b0bc5b7ca29e423560c5a8d476973722699d2078811
SHA1 hash: 77dd56ea80034760769f2fcaf2529ba8abceb115
MD5 hash: dc88a2e75a03524ab6592154fd2c82fd
humanhash: montana-stream-tennessee-high
File name:SecuriteInfo.com.NSIS.Malware-gen.2435
Download: download sample
Signature GuLoader
Create hunting rule
File size:426'032 bytes
First seen:2022-09-22 13:00:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (527 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep 6144:imOP8vxPGEVS87lLaYC3HPGYDKO7/XuFlx17i/963CECfOYcQmF:XvxlVS87lCvGWA7uQ3CECXM
TLSH T19594E005E4C1C3B2CC3189319313C9223BF56DB9D7D35B1EB2D8B74924725D2AB6EA1A
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 882ceec2b6b292e7 (3 x GuLoader)
Reporter SecuriteInfoCom
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-09-22T04:30:48Z
Valid to:2025-09-21T04:30:48Z
Serial number: 0a363b662c07df4c
Thumbprint Algorithm:SHA256
Thumbprint: a2240f7fd9c7695117e501fb0e7d1780c474115657cbe51b7676bb87f7ad7ca2
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
437
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.NSIS.Malware-gen.2435
Verdict:
Malicious activity
Analysis date:
2022-09-22 13:01:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ca5aeb6f-e602-487b-95e6-20d2f115cb52

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/312350/
Detection(s):
SecuriteInfo.com.NSIS.Malware-gen.2435.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Creating a file
Searching for the window
Searching for the Windows task manager window
Launching a process
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/38470/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
75%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/632c5d1b1bf7950e75aff45d/reports/14a6576b-6587-4b30-b157-4adfe1882faf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9830fab0-4797-47c3-a4bf-c6701485b164
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1075282
Signature
Mass process execution to delay analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to detect Any.run
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 707824 Sample: SecuriteInfo.com.NSIS.Malwa... Startdate: 22/09/2022 Architecture: WINDOWS Score: 60 42 univers-t.ro 2->42 46 Yara detected GuLoader 2->46 8 SecuriteInfo.com.NSIS.Malware-gen.2435.exe 3 40 2->8         started        signatures3 process4 file5 34 C:\Users\user\AppData\...\uTMPVImporter.dll, PE32 8->34 dropped 36 C:\Users\user\...\System.Runtime.Numerics.dll, PE32+ 8->36 dropped 38 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\...\System.dll, PE32 8->40 dropped 48 Mass process execution to delay analysis 8->48 50 Tries to detect Any.run 8->50 12 powershell.exe 8->12         started        15 SecuriteInfo.com.NSIS.Malware-gen.2435.exe 8->15         started        18 powershell.exe 8->18         started        20 96 other processes 8->20 signatures6 process7 dnsIp8 52 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 12->52 22 conhost.exe 12->22         started        44 univers-t.ro 185.146.86.240, 443, 49757 GTSCEGTSCentralEuropeAntelGermanyCZ Romania 15->44 54 Tries to detect Any.run 15->54 24 conhost.exe 18->24         started        26 conhost.exe 20->26         started        28 conhost.exe 20->28         started        30 conhost.exe 20->30         started        32 93 other processes 20->32 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03c0b10be2c560acd4c9772a9fb19c271ee143592ec316c580a3b4a6e433a219/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2022-09-22 08:29:36 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
2 of 41 (4.88%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=apalcc7cyvqkzvgjo4vj7mm4e4pocq2zf3brnrmauo2knzbtuimq._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader discovery downloader
Link:
https://tria.ge/reports/220922-p872jafcen/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks installed software on the system
Loads dropped DLL
Guloader,Cloudeye
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/eebb9aec-e6ae-4ac1-a45d-0ea7658a5683
Unpacked files
SH256 hash:
938580b466533dfa1461e9858fd106b60e1a52b713380915cc03afd3e4b4573c
MD5 hash:
98bdb37511634dad8d1236d91d373b26
SHA1 hash:
778cf74b4f8860cc378fa4e61aeba318197783ce
Link:
https://www.unpac.me/results/a62ae274-2d8f-4df8-ae20-d4a9f8603c68/
SH256 hash:
e5833465f31ec6d0df2a249280ee229862f55413a9c99edd666fed47344315cf
MD5 hash:
7c3d79e4d4b4751ffe78ec68221565f4
SHA1 hash:
6aebe07d0a17534fb2d6e1ef8a09f3919ee6da72
Link:
https://www.unpac.me/results/a62ae274-2d8f-4df8-ae20-d4a9f8603c68/
SH256 hash:
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 hash:
8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 hash:
223bef1f19e644a610a0877d01eadc9e28299509
Link:
https://www.unpac.me/results/a62ae274-2d8f-4df8-ae20-d4a9f8603c68/
SH256 hash:
f7d98be26c813724c7cb673b53475fe660d3ef4f9930d57a550c91578c660e91
MD5 hash:
723646252e79cbb15c7817360f93a6d2
SHA1 hash:
c9ce61d71b7377456ab49c823fc756336b01f7b5
Link:
https://www.unpac.me/results/a62ae274-2d8f-4df8-ae20-d4a9f8603c68/
SH256 hash:
4c79dddbef98ec0e4b85351ab959121f821423aeac6bc98ee7a8b8f77bad92b4
MD5 hash:
d97357a6e0d6b03a9b49fe30d0008328
SHA1 hash:
4aa3d1fbf9a731b191c1315054b3f5a27c22bf0c
Link:
https://www.unpac.me/results/a62ae274-2d8f-4df8-ae20-d4a9f8603c68/
SH256 hash:
03c0b10be2c560acd4c9772a9fb19c271ee143592ec316c580a3b4a6e433a219
MD5 hash:
dc88a2e75a03524ab6592154fd2c82fd
SHA1 hash:
77dd56ea80034760769f2fcaf2529ba8abceb115
Link:
https://www.unpac.me/results/a62ae274-2d8f-4df8-ae20-d4a9f8603c68/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/03c0b10be2c560acd4c9772a9fb19c271ee143592ec316c580a3b4a6e433a219

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/312350/

Comments