MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f9a3149d869c89dce449fb41b56ac6d1d92cd86ebed8b480094efde569074c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f9a3149d869c89dce449fb41b56ac6d1d92cd86ebed8b480094efde569074c9
SHA3-384 hash: 8240cec6eb9f2908c0bca5f516284ceca63320479883167ecf60c5b61abd1a1a614aed9b1b50d7d4eb8dd26b0cb4b48a
SHA1 hash: fb32c07cad89788a8e6518f1f459d922c91184bc
MD5 hash: 7b66b2ed9a15c047f75ae00bf55cb7f8
humanhash: arkansas-crazy-alabama-thirteen
File name:SecuriteInfo.com.W32.Injector.OHYF-3135.25928.26136
Download: download sample
Signature GuLoader
Create hunting rule
File size:354'800 bytes
First seen:2022-09-01 07:39:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (388 x GuLoader, 59 x RemcosRAT, 44 x VIPKeylogger)
ssdeep 6144:eLsBN8xoIiL54j0CCRALS9f1nNv5oNBnXnIyTxGa1Z9dpPLwKWkJ3CP:5Boj0CfuNv5ovnXnRTTZ9bdJ3a
TLSH T15374F193B61869E3D8A8983240270BB267757C7A97855A1372C5FE37B833353D70E31A
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 7c5ccdbf8eacd4d4 (3 x GuLoader)
Reporter SecuriteInfoCom
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Mantraps Gasunitter Moistens
Issuer:Mantraps Gasunitter Moistens
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-23T09:32:12Z
Valid to:2025-05-22T09:32:12Z
Serial number: -48a6e39736638bfb
Thumbprint Algorithm:SHA256
Thumbprint: d5529ab2ac8802cdd9d2110cfec35674a1765e5112a0e1bb8bf38bea0c80973a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
255
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.Injector.OHYF-3135.25928.26136
Verdict:
Malicious activity
Analysis date:
2022-09-01 09:28:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cecc9586-de1c-46dd-ba52-0dbf3efa6fb7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/307106/
Detection(s):
SecuriteInfo.com.W32.Injector.OHYF-3135.25928.26136.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a file in the %temp% subdirectories
Delayed reading of the file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/36268/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/631062133e9e50b1baf3697e/reports/4dd44899-ec02-4435-8993-94d1ba8fcf68/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/72d3aa7d-e0bb-4a9a-be58-5bf845e95ad5
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1062563
Signature
Multi AV Scanner detection for submitted file
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f9a3149d869c89dce449fb41b56ac6d1d92cd86ebed8b480094efde569074c9/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2022-09-01 07:08:26 UTC
File Type:
PE (Exe)
Extracted files:
85
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6ndcsoynhej3tset62bwvvmnuozftmg5pwywsaastx54vuqoteq._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader
Link:
https://tria.ge/reports/220901-jhjncsaccn/
Behaviour
Enumerates physical storage devices
Loads dropped DLL
Guloader,Cloudeye
Unpacked files
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/ff1bd4f2-87db-49d8-a229-a5488c82c6b3/
SH256 hash:
0f9a3149d869c89dce449fb41b56ac6d1d92cd86ebed8b480094efde569074c9
MD5 hash:
7b66b2ed9a15c047f75ae00bf55cb7f8
SHA1 hash:
fb32c07cad89788a8e6518f1f459d922c91184bc
Link:
https://www.unpac.me/results/ff1bd4f2-87db-49d8-a229-a5488c82c6b3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0f9a3149d869c89dce449fb41b56ac6d1d92cd86ebed8b480094efde569074c9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/307106/

Comments