MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07705270aaa5e16a07fb2180150cf0cac5da28cd8a12347bddc7c8f283459117. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07705270aaa5e16a07fb2180150cf0cac5da28cd8a12347bddc7c8f283459117
SHA3-384 hash: 1613dd2114d10a4ff39ef8569fd94d1f6e9679eb80dfc5bd3d6bd7a2b77c93592b74d1dc616807e0ebe7dbc929a4d459
SHA1 hash: 02a1c95ecb3d3b7cc9acaf9c7cfd027c34bce74a
MD5 hash: c56494142ba3bc8a795ae06b599761a9
humanhash: speaker-low-crazy-hydrogen
File name:ARRIVAL NOTICE = MV.ZHONG GU BEI HAI V.21037S = ZGTAO0350000514 SIHPH00242222_2022-CAT LAI_VIETNAM.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'044'552 bytes
First seen:2022-10-24 17:37:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3abe302b6d9a1256e6a915429af4ffd2 (271 x GuLoader, 38 x Formbook, 25 x Loki)
ssdeep 24576:vhUTEGzmVjoNsfAyrOFrgU6pjH69feWzY8abst3:zgmVKFrwpb69f1Y8Is
Threatray 656 similar samples on MalwareBazaar
TLSH T10C252390BA89E87ACA61133849B2DD3A437AAFE03D32D51F274E77663F373D21525046
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Anonymous
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-06-07T06:27:19Z
Valid to:2025-06-06T06:27:19Z
Serial number: 3d697dd19de4f4e4
Thumbprint Algorithm:SHA256
Thumbprint: 909485c21c37e324b7ca1c28b1f4c393103f32cd7abedf296e1196adddae3e47
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
guloader
Create hunting rule
ID:
1
File name:
ARRIVAL NOTICE = MV.ZHONG GU BEI HAI V.21037S = ZGTAO0350000514 SIHPH00242222_2022-CAT LAI_VIETNAM.exe
Verdict:
Malicious activity
Analysis date:
2022-10-24 17:37:43 UTC
Tags:
guloader
Link:
https://app.any.run/tasks/7ea5512d-85a0-44d2-93d8-37868c6d4309

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/323544/
Detection(s):
SecuriteInfo.com.BackDoor.HRDP.38.4359.6678.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a file in the %temp% subdirectories
Delayed reading of the file
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/45089/overview
Behaviour
MalwareBazaar
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0380e759-9b72-46c2-8336-5eac05abaef6
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1096801
Signature
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07705270aaa5e16a07fb2180150cf0cac5da28cd8a12347bddc7c8f283459117/
Threat name:
Win32.Downloader.Minix
Create hunting rule
Status:
Malicious
First seen:
2022-10-18 06:02:41 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
8 of 41 (19.51%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a5yfe4fkuxqwub73egabkdhqzlc5ukgnrijdi665y7epfa2fselq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
07a313a7a49c4b8c0fafa65f3779a32ffa3f8cd52073fc38a657189839b91668
GuLoader
194fe792044279124a5e298a697897e99df0dd83f7c51d6bee295b447810531d
GuLoader
28ae6b089bb3e28d0e927fddc34b774a349589c9a62c8636b63a060bb8d5cdb9
GuLoader
4d688c6baec0d972c248f7747f18dc385e67a0fb2b1a5deb70f324b16220780d
GuLoader
778463dc4bc09f828ebcadef7aa7d828f5d1240b6adbf4dff33d7938a62e485e
GuLoader
95b9a3dab50db7b096629c3f9265b131627909ddeffdcab6da1093a4f4e83fd3
GuLoader
c30ce79d7b5b0708dc03f1532fa89afd4efd732531cb557dc31fe63acd5bc1ce
GuLoader
+ 646 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/221024-v7qczshhcq/
Behaviour
Enumerates physical storage devices
Drops file in Windows directory
Checks installed software on the system
Loads dropped DLL
Unpacked files
SH256 hash:
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 hash:
fbe295e5a1acfbd0a6271898f885fe6a
SHA1 hash:
d6d205922e61635472efb13c2bb92c9ac6cb96da
Link:
https://www.unpac.me/results/55c7ab98-ad46-4a95-b7ff-2d487340b99f/
SH256 hash:
07705270aaa5e16a07fb2180150cf0cac5da28cd8a12347bddc7c8f283459117
MD5 hash:
c56494142ba3bc8a795ae06b599761a9
SHA1 hash:
02a1c95ecb3d3b7cc9acaf9c7cfd027c34bce74a
Link:
https://www.unpac.me/results/55c7ab98-ad46-4a95-b7ff-2d487340b99f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/07705270aaa5e16a07fb2180150cf0cac5da28cd8a12347bddc7c8f283459117

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/323544/

Comments