MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 198c4b09ed4b8a46cfca9fd672797c0bb6f6d9a84016fd4f699ec65be9b9de3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 198c4b09ed4b8a46cfca9fd672797c0bb6f6d9a84016fd4f699ec65be9b9de3d
SHA3-384 hash: f2faeb49cbcaf85cdf5a9597c26f8b9dd5fa67fa30375b24926159bedc3df08de709ecfb2b93eacc16a3fcf79c8e8494
SHA1 hash: 7832e5c3f52a4227e49b77968b2e316a4f575363
MD5 hash: f5da0115ae4a3eb7b325a8756b1013f7
humanhash: rugby-december-stream-tango
File name:198c4b09ed4b8a46cfca9fd672797c0bb6f6d9a84016fd4f699ec65be9b9de3d
Download: download sample
Signature GuLoader
Create hunting rule
File size:301'330 bytes
First seen:2023-04-04 12:02:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6e7f9a29f2c85394521a08b9f31f6275 (278 x GuLoader, 44 x RemcosRAT, 40 x VIPKeylogger)
ssdeep 6144:GT4DtMmNNsXLWs9baMwEyGnTaaZOMnUivg5FLJTQhli0xk74/S:GT9XLWszTa9Mdvg5FxQXi0xx/S
Threatray 537 similar samples on MalwareBazaar
TLSH T16054122137409173D5F32936182A567B8E76EC7176A4CE8987403E6FECB19F3991A3C1
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 60e4f4d86c6474fc (2 x GuLoader)
Reporter adrian__luca
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
244
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
198c4b09ed4b8a46cfca9fd672797c0bb6f6d9a84016fd4f699ec65be9b9de3d
Verdict:
Suspicious activity
Analysis date:
2023-04-04 12:02:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/652c407b-beae-46da-a161-92c7068cc750

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/380000/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66087905.17616.6864.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Creating a file in the %temp% subdirectories
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/76490/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo guloader overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/642c11f6497fb6f23efd5177/reports/8c8964f2-a630-48af-afd1-5a653a92d109/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/198c4b09ed4b8a46cfca9fd672797c0bb6f6d9a84016fd4f699ec65be9b9de3d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/dd1e403e-6ce5-4ab2-bb78-35d9cb1b38ce
Result
Threat name:
Remcos, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1208012
Signature
C2 URLs / IPs found in malware configuration
Installs a global keyboard hook
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to detect Any.run
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 840927 Sample: m3AGJOY0QG.exe Startdate: 04/04/2023 Architecture: WINDOWS Score: 100 52 darren2023.sytes.net 2->52 54 googlehosted.l.googleusercontent.com 2->54 56 2 other IPs or domains 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 Yara detected GuLoader 2->60 62 Yara detected Remcos RAT 2->62 64 2 other signatures 2->64 9 m3AGJOY0QG.exe 35 2->9         started        13 scs.exe 22 2->13         started        15 scs.exe 22 2->15         started        signatures3 process4 file5 36 C:\Users\user\AppData\...\Hallowmas.Blo, data 9->36 dropped 38 C:\Users\user\AppData\Local\...\System.dll, PE32 9->38 dropped 70 Tries to detect Any.run 9->70 17 m3AGJOY0QG.exe 2 9 9->17         started        40 C:\Users\user\AppData\Local\...\System.dll, PE32 13->40 dropped 22 scs.exe 13->22         started        42 C:\Users\user\AppData\Local\...\System.dll, PE32 15->42 dropped 24 WerFault.exe 15->24         started        signatures6 process7 dnsIp8 46 drive.google.com 142.250.184.238, 443, 49820, 49827 GOOGLEUS United States 17->46 48 googlehosted.l.googleusercontent.com 142.250.186.129, 443, 49821, 49828 GOOGLEUS United States 17->48 32 C:\Users\user\AppData\Roaming\scs.exe, PE32 17->32 dropped 34 C:\Users\user\...\scs.exe:Zone.Identifier, ASCII 17->34 dropped 66 Tries to detect Any.run 17->66 26 scs.exe 22 17->26         started        50 darren2023.sytes.net 139.28.38.14, 2115 FREEHOSTUA Ukraine 22->50 68 Installs a global keyboard hook 22->68 file9 signatures10 process11 file12 44 C:\Users\user\AppData\Local\...\System.dll, PE32 26->44 dropped 72 Multi AV Scanner detection for dropped file 26->72 30 WerFault.exe 21 16 26->30         started        signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/198c4b09ed4b8a46cfca9fd672797c0bb6f6d9a84016fd4f699ec65be9b9de3d/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-03-24 10:25:08 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
23 of 37 (62.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dggewcpnjofent6kt7lhe6l4bo3pnwniialp2t3jt3dfx2nz3y6q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
cloudeye
Create hunting rule
Similar samples:
28ca1fe12d85075d947b1bc3292c14cba784ed1e22287e56819d9a1d86b2f7e4
GuLoader
3666ce56e887d867222132b76a82a13d0cacda0aa69011bfd3dcd66ee1a21d39
GuLoader
3e924b372c019c41e9995a276ce5c1b1487d14ceb9fbc8d606a09a83df5989b8
GuLoader
459402e839737411be96df513c2c48e83055fb1fb92f4773876275de2acb47bb
GuLoader
85abebc375aa136c35b7efbdcdf2e511cdc48a3123504a4cb9666a99ddff3921
GuLoader
974d4a3b79743a94417f467ffbaeb5de6616d2f5f5aef742f41b7a5d5a3d9ba7
GuLoader
c3a3c6015ffc1bc98b5a21f89e78049900e5796e67e098bead011a20a99e7b0d
GuLoader
d99fdee30a323b0ed4cfbd9c4661530f45b368f829869604fb9a83debfff7a32
GuLoader
f4716cf29a2fa3ff5650ff6a4d35a26a5a534658fe7518fdf2c08554158db841
GuLoader
ff3949d2a8e0d6b08d2b8b643cdfc6a26f44352da217b4a537e9c16d96ed7198
GuLoader
+ 527 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:remotehost downloader persistence rat
Link:
https://tria.ge/reports/230404-n7116agf2t/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Guloader,Cloudeye
Remcos
Malware Config
C2 Extraction:
darren2023.sytes.net:2115
Unpacked files
SH256 hash:
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 hash:
564bb0373067e1785cba7e4c24aab4bf
SHA1 hash:
7c9416a01d821b10b2eef97b80899d24014d6fc1
Link:
https://www.unpac.me/results/770a02c9-cca7-41e5-8eb9-fc312cdbfd5b/
SH256 hash:
198c4b09ed4b8a46cfca9fd672797c0bb6f6d9a84016fd4f699ec65be9b9de3d
MD5 hash:
f5da0115ae4a3eb7b325a8756b1013f7
SHA1 hash:
7832e5c3f52a4227e49b77968b2e316a4f575363
Link:
https://www.unpac.me/results/770a02c9-cca7-41e5-8eb9-fc312cdbfd5b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/198c4b09ed4b8a46cfca9fd672797c0bb6f6d9a84016fd4f699ec65be9b9de3d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/380000/

Comments