🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1602325d55a3537877b0a08c80dfd34f69a12b08d10af3b5aec5479fac779283. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1602325d55a3537877b0a08c80dfd34f69a12b08d10af3b5aec5479fac779283
SHA3-384 hash: 05f43b3f20b115a86c0c8ab3941470dee0aaf2cc54b0c23e47d459418f930b1af302d2057bdaf9cd182e0b1b6dab4e4a
SHA1 hash: fe357f74ea47ba6319fe68240131f19c9ae2664d
MD5 hash: e0cdd543f142a8cb51c02d2229f9602d
humanhash: oranges-cola-lamp-lima
File name:FACTURA-002297.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:569'120 bytes
First seen:2024-10-03 13:11:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f23f452093b5c1ff091a2f9fb4fa3e9 (305 x GuLoader, 47 x AgentTesla, 47 x RemcosRAT)
ssdeep 6144:HIw3/aVqeUyFpR211QqcrrGmMvL41GTpiEBsfnZlcaAX4TUjiSiilU9t75k2hWjE:HaPF609uJ41kpiEoRAoARlU6tPzcP
Threatray 543 similar samples on MalwareBazaar
TLSH T1CFC4DFAB6DD3C8DEC803063099A5B6B5B6F19DF09703AD0763B33BE82D32E518E45255
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon c4c2f0f8f83cbede (6 x GuLoader)
Reporter James_inthe_box
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Teoriundervisningers Karaktertrkkets Erstatningstegns
Issuer:Teoriundervisningers Karaktertrkkets Erstatningstegns
Algorithm:sha256WithRSAEncryption
Valid from:2024-05-17T10:03:15Z
Valid to:2027-05-17T10:03:15Z
Serial number: 04048296e13cf560a13f4632c4b9f30dbcbc11b5
Thumbprint Algorithm:SHA256
Thumbprint: c6deb1791444cae01731b717e532db234a83ebc42f793b76c17a2e521c680fbd
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
387
Origin country :
US US
Vendor Threat Intelligence
Malware family:
guloader
Create hunting rule
ID:
1
File name:
FACTURA-002297.exe
Verdict:
Malicious activity
Analysis date:
2024-10-03 13:14:23 UTC
Tags:
guloader
Link:
https://app.any.run/tasks/d998bc4c-7806-4632-bb39-a089f9e235cb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66fe9832780a9b632d22aa66
Tags:
Injection Exploit Obfusc Nsis
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
installer lolbin masquerade microsoft_visual_cc overlay packed shell32
Link:
https://www.filescan.io/uploads/66fe982370ee93675e14fc94/reports/3b8e1ea9-d939-4dd0-a262-8a4c51641962/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/1602325d55a3537877b0a08c80dfd34f69a12b08d10af3b5aec5479fac779283
Malware family:
Unlabeled
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b442f7a6-b1eb-478b-b84f-7bcb81120ad2
Result
Threat name:
GuLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1524995
Signature
Antivirus / Scanner detection for submitted sample
Found direct / indirect Syscall (likely to bypass EDR)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1524995 Sample: FACTURA-002297.exe Startdate: 03/10/2024 Architecture: WINDOWS Score: 100 28 drive.usercontent.google.com 2->28 30 drive.google.com 2->30 38 Malicious sample detected (through community Yara rule) 2->38 40 Antivirus / Scanner detection for submitted sample 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 2 other signatures 2->44 10 FACTURA-002297.exe 1 28 2->10         started        signatures3 process4 file5 26 C:\Users\user\AppData\Local\...\System.dll, PE32 10->26 dropped 52 Switches to a custom stack to bypass stack traces 10->52 14 FACTURA-002297.exe 6 10->14         started        signatures6 process7 dnsIp8 32 drive.usercontent.google.com 142.250.81.225, 443, 49805 GOOGLEUS United States 14->32 34 drive.google.com 142.251.32.110, 443, 49804 GOOGLEUS United States 14->34 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Queues an APC in another process (thread injection) 14->58 60 Found direct / indirect Syscall (likely to bypass EDR) 14->60 18 RAVCpl64.exe 14->18 injected signatures9 process10 signatures11 36 Found direct / indirect Syscall (likely to bypass EDR) 18->36 21 SecEdit.exe 18->21         started        process12 signatures13 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Switches to a custom stack to bypass stack traces 21->50 24 explorer.exe 60 1 21->24 injected process14
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1602325d55a3537877b0a08c80dfd34f69a12b08d10af3b5aec5479fac779283
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1602325d55a3537877b0a08c80dfd34f69a12b08d10af3b5aec5479fac779283/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2024-10-03 12:36:42 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cybdexkvunjxq55qucgibx6tj5u2ckyi2efphnnoyvdz7ldxskbq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
cloudeye
Create hunting rule
Similar samples:
0394b5d83b6fa63b6c661265ce44b6036027af24c5c316050b607647a73d3541
GuLoader
0f849525b31bc8eb26642e47cdcf9a3b9c945e5e481dd427a3175486278ac2db
GuLoader
936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467
GuLoader
b55c1221a5a347fbbb9c80a65e2904fa915c6cf2553c742643ef0a4d4261059d
GuLoader
d3a66173013a037b63d6ab4eb79916bb7e32cea117a3a12ed823f1f41ee69ce2
GuLoader
d418b33e0f47d43fcc31e623c7c2b581aa9df51fb47a15414a8bb45b009f813b
GuLoader
error
GuLoader
+ 533 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader discovery downloader
Link:
https://tria.ge/reports/241003-qfg53syanm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Guloader,Cloudeye
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/404ee805-fa69-4041-bb71-bb31e764e235
Unpacked files
SH256 hash:
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 hash:
8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 hash:
223bef1f19e644a610a0877d01eadc9e28299509
Link:
https://www.unpac.me/results/35c4f6c9-29be-40e6-beae-0fd6f0faac62/
SH256 hash:
1602325d55a3537877b0a08c80dfd34f69a12b08d10af3b5aec5479fac779283
MD5 hash:
e0cdd543f142a8cb51c02d2229f9602d
SHA1 hash:
fe357f74ea47ba6319fe68240131f19c9ae2664d
Link:
https://www.unpac.me/results/35c4f6c9-29be-40e6-beae-0fd6f0faac62/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1602325d55a3537877b0a08c80dfd34f69a12b08d10af3b5aec5479fac779283

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 1602325d55a3537877b0a08c80dfd34f69a12b08d10af3b5aec5479fac779283

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileExW
KERNEL32.dll::MoveFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments