MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c3bffacf3e541cfdd0b5552e048c57d313252709926031f1d4672717f9beae3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c3bffacf3e541cfdd0b5552e048c57d313252709926031f1d4672717f9beae3
SHA3-384 hash: 9588bd66f829667e5892989405924dd8a803652cfbe848c2a768382164dc87220c34c0d4efe8cc26a7f87026902ee87f
SHA1 hash: 76a8fb1019b23332ccbc063bd728161a8526b77c
MD5 hash: 15bd7ba990de7dee70a8a935cf587951
humanhash: yankee-september-mango-quebec
File name:SecuriteInfo.com.HEUR.Trojan.Win32.GuLoader.gen.1736.28639
Download: download sample
Signature GuLoader
Create hunting rule
File size:991'960 bytes
First seen:2022-10-11 13:46:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (385 x GuLoader, 58 x RemcosRAT, 40 x AgentTesla)
ssdeep 24576:9ib7FQchlraowtRLdNS4Z8gI3omKwep0xkMSW3+Wt6CTr:G7Fn5aT7S4ydCukMeY6G
Threatray 1'293 similar samples on MalwareBazaar
TLSH T1E42523B473E1C122D652D630D43A7439CEF9DE610461A49737EC7635B838AEC8E8F25A
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 81b9dada86cd31c5 (1 x GuLoader, 1 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-09T07:32:28Z
Valid to:2025-05-08T07:32:28Z
Serial number: 483c5be6941e5765
Thumbprint Algorithm:SHA256
Thumbprint: 22e38eff68eb7642a1a40ac9b960d167dd0a98acd013f3d8eaebf2e253b8aeea
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
351
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318970/
Detection(s):
SecuriteInfo.com.HEUR.Trojan.Win32.GuLoader.gen.1736.28639.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Windows subdirectories
Creating a file
DNS request
Delayed reading of the file
Creating a file in the Program Files subdirectories
Searching for the window
Creating a file in the %temp% subdirectories
Searching for the Windows task manager window
Launching a process
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42511/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/634573d784a686684c9a6d97/reports/92bed34c-d9af-43c7-9ab1-aa07a54bc76e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/703edc96-ceee-4b5f-85be-99738a662599
Result
Threat name:
GuLoader, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1088042
Signature
Machine Learning detection for sample
Mass process execution to delay analysis
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected GuLoader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 720634 Sample: SecuriteInfo.com.HEUR.Troja... Startdate: 11/10/2022 Architecture: WINDOWS Score: 100 45 api.ip.sb 2->45 47 movbihf.tk 2->47 49 ipinfo.io 2->49 57 Snort IDS alert for network traffic 2->57 59 Yara detected GuLoader 2->59 61 Yara detected RedLine Stealer 2->61 63 4 other signatures 2->63 8 SecuriteInfo.com.HEUR.Trojan.Win32.GuLoader.gen.1736.28639.exe 14 73 2->8         started        signatures3 process4 file5 37 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->37 dropped 39 C:\Users\user\AppData\Local\...\System.dll, PE32 8->39 dropped 41 C:\Users\user\AppData\...\libpng16-16.dll, PE32+ 8->41 dropped 43 4 other files (none is malicious) 8->43 dropped 67 Writes to foreign memory regions 8->67 69 Mass process execution to delay analysis 8->69 71 Tries to detect Any.run 8->71 12 CasPol.exe 8->12         started        16 powershell.exe 8->16         started        18 powershell.exe 8->18         started        20 71 other processes 8->20 signatures6 process7 dnsIp8 51 ipinfo.io 34.117.59.81, 443, 49849 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 12->51 53 185.29.10.203, 49846, 49851, 49852 DATACLUB-SE European Union 12->53 55 movbihf.tk 132.148.73.81, 443, 49845 AS-26496-GO-DADDY-COM-LLCUS United States 12->55 73 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->73 75 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 12->75 77 Tries to harvest and steal browser information (history, passwords, etc) 12->77 81 2 other signatures 12->81 22 conhost.exe 12->22         started        79 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 16->79 24 conhost.exe 16->24         started        27 conhost.exe 18->27         started        29 conhost.exe 20->29         started        31 conhost.exe 20->31         started        33 conhost.exe 20->33         started        35 68 other processes 20->35 signatures9 process10 signatures11 65 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 24->65
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c3bffacf3e541cfdd0b5552e048c57d313252709926031f1d4672717f9beae3/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2022-10-11 10:30:09 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
27 of 42 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bq577lht4va47xilkvjoasgfpuyteutqtetaghy5izzhc7435lrq._file
Verdict:
malicious
Similar samples:
275db34b1b3d894ed18fba50f477ca897bb3656682c7d0ef2941bd7c696e9f80
GuLoader
595f2ae803f01eba157b6deff4687380346e15609e43cc05b541b527bb7292eb
GuLoader
5fd8c33a5491be40bb0685430728361feb280f92f318f7f0a327bd63fca86f99
GuLoader
7132f9426f3bbadaedd15c39968640ffc5ad207b3c8f450d642174e2942f09d7
GuLoader
7d99aa5b81da99461aa61d5542cabce7bc5ffedc56cd1c1d9d6e58e242b38802
GuLoader
a18ab93f8c9268841b6cd59842a935651d9267fa2b8f72b2196cf68f7b57df9d
GuLoader
a9acac2bc60cd65b24257dcd59cba1f79a5d8ebe6b68cffef12968038acd2675
GuLoader
e5653285dfebc9a95f3a866693752e3f0e62ae312aaf054249067e22cf5836a5
GuLoader
f46d8267eb7fe636d2c5183100bc97e4a93b3a21c5d15661a3dc49ae891f621d
GuLoader
+ 1'283 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/221011-q3h1wsgch6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Checks installed software on the system
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4f2fc522-9734-4a41-95af-16ff67ac66fd
Unpacked files
SH256 hash:
80b76b73d2d143b5db4e2d2e24438a68647ae96ac37289415c1caef5c2ed63d3
MD5 hash:
1b76bca7bef0f515d39f31e3c084f31d
SHA1 hash:
92705562f13db5967e66624286f8291477b7b217
Link:
https://www.unpac.me/results/47c06fb4-915d-4c17-8159-ac4d29b5a5a3/
SH256 hash:
9d1849425597da7e314adb3d6300f6a6cf70aecebdd36276120a4f399a0ca14c
MD5 hash:
e89c979ddf75a064ea3cd8d5cca760f7
SHA1 hash:
a6774daf7206644c96411186b09639e5426f0513
Link:
https://www.unpac.me/results/47c06fb4-915d-4c17-8159-ac4d29b5a5a3/
SH256 hash:
0c3bffacf3e541cfdd0b5552e048c57d313252709926031f1d4672717f9beae3
MD5 hash:
15bd7ba990de7dee70a8a935cf587951
SHA1 hash:
76a8fb1019b23332ccbc063bd728161a8526b77c
Link:
https://www.unpac.me/results/47c06fb4-915d-4c17-8159-ac4d29b5a5a3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c3bffacf3e541cfdd0b5552e048c57d313252709926031f1d4672717f9beae3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/318970/

Comments