MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 152acaebcc2ede3d62e20ff008beb789c05490dff5af71854d98bb55ffbcea73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	152acaebcc2ede3d62e20ff008beb789c05490dff5af71854d98bb55ffbcea73
SHA3-384 hash:	81ba1687c0e2abbea2d7a22dd9a4c26b028c47f4607841be02fe5c2df4ebf3bcc98fc82f912082b7c017490db71c3e34
SHA1 hash:	dc3366bd76bf958057ef9ba42679a9be14b958b6
MD5 hash:	62ee57101f0b00549c0396a9968f15f1
humanhash:	carbon-winter-lake-triple
File name:	SecuriteInfo.com.Win32.MalwareX-gen.27188.31274
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	418'319 bytes
First seen:	2023-06-19 15:33:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	66fcdd6338ffed276966867e7cf86116 (9 x GuLoader, 2 x AgentTesla, 2 x RemcosRAT)
ssdeep	6144:G0xJt5VE93zhGpt5dC9WjcXtdpgwaL8WnwfaWUkTCOrEGD+W8x0GmMw:G0Z493ot5dCDtdpgwaL8WnUFGMF+m7
Threatray	44 similar samples on MalwareBazaar
TLSH	T1B794AED1E95488D6EDE717F10C6E9A2020B36D5E90E4920E71E67E177AB3383206BD4F
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	f49c98c8982c541c (1 x GuLoader)
Reporter	SecuriteInfoCom
Tags:	exe GuLoader

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

302

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

SecuriteInfo.com.Win32.MalwareX-gen.27188.31274

Verdict:

Suspicious activity

Analysis date:

2023-06-19 15:33:42 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3a9f3b44-1e9d-4f31-8114-70416ef8c2b8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/400596/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.27188.31274.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file

Creating a file in the %temp% subdirectories

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/91638/overview

Behaviour

MalwareBazaar

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lolbin overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/6490756a1bc6cbebc9b574e2/reports/9d464641-ec85-4c65-a598-2cb82436dc73/overview

Hybrid Analysis Win/malicious_confidence_70%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/152acaebcc2ede3d62e20ff008beb789c05490dff5af71854d98bb55ffbcea73

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d245ca9f-f2de-4e51-9cf4-79063c56ed8d

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1257525

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/152acaebcc2ede3d62e20ff008beb789c05490dff5af71854d98bb55ffbcea73/

ReversingLabs TitaniumCloud Win32.Trojan.Guloader

Threat name:

Win32.Trojan.Guloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-19 05:13:50 UTC

File Type:

PE (Exe)

Extracted files:

5

AV detection:

13 of 36 (36.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cuvmv26mf3pd2yxcb7yarpvxrhafjeg76wxxdbkntc5vl7545jzq._file

Threatray cloudeye

Verdict:

malicious

Label(s):

cloudeye

Alert

Create hunting rule

Similar samples:

1cd3cee13fd4653e084327ebf599147a9bcddf5213b332ae928f63f551d3b3f0

GuLoader

2fa9ce048f2aef4542de0f78a824ef4576c435e4275ada3ab8fa3b6db84ac16a

GuLoader

3a5ec656b7ac0c3c49b84b396af79a7d899ba525251084b7dfbdea4f95d04388

GuLoader

44b7dfcb3fee43eb6de84138c06b2fde701eac3521328c4c861cb64a5a44e429

GuLoader

53023be2fcec8386a9861d6eac232020a1a9c0804fe9293e5fc206e8f19b4575

GuLoader

7eb60e087050a8429a68dcf26beb489315dab14ac3b09e00611d349c38055545

GuLoader

80ba5d77bf23701d83f91b9158e5b3ba36e01c83f2b2469aada56e81a428a224

GuLoader

841ce7f81f9a7e7fb55e185c2cd20b3f535011e4bcd510efc3128027b19c77fd

GuLoader

92b742ab79fb91de45b3b90edbcf64515f21cb10f1585e868d92ebf3c4060f13

GuLoader

b98d60109c9ccfaac33c719992c026b59e3bc54bbe9fe24bc0fecaa016a02959

GuLoader

+ 34 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230619-szq87seg74/

Behaviour

Enumerates physical storage devices

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

ce36bf0aee943edddfd4c5634333da5cdeabc270c6ae56ecc39a344fde25e06a

MD5 hash:

b5f2250ac5c8821a68457d4ad341a1dd

SHA1 hash:

7b82c09b95ab9c113ef9a0d853aa05d9560d7fa2

Link:

https://www.unpac.me/results/46c2d1a2-91cd-43e0-8ad7-b5f43a623885/

SH256 hash:

152acaebcc2ede3d62e20ff008beb789c05490dff5af71854d98bb55ffbcea73

MD5 hash:

62ee57101f0b00549c0396a9968f15f1

SHA1 hash:

dc3366bd76bf958057ef9ba42679a9be14b958b6

Link:

https://www.unpac.me/results/46c2d1a2-91cd-43e0-8ad7-b5f43a623885/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/152acaebcc2ede3d62e20ff008beb789c05490dff5af71854d98bb55ffbcea73

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/400596/