MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1be03967a615254ca0b3eba8b5aaa6b5f5c91c9f03d4fe2692b3675f93c0b26d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1be03967a615254ca0b3eba8b5aaa6b5f5c91c9f03d4fe2692b3675f93c0b26d
SHA3-384 hash: dffa62173ebbfd67c3d2b3b097b272b3bbc288ccf8d76348820dd55763bdcee76cc43fb716c9fe5a16d1246a73396afa
SHA1 hash: b709d7968897d774676194b9708f304a6a472086
MD5 hash: 09d431a8321ec75d7ff057787c319897
humanhash: magazine-helium-pizza-muppet
File name:SecuriteInfo.com.Gen.Variant.Nemesis.6939.7902.26603
Download: download sample
Signature GuLoader
Create hunting rule
File size:150'224 bytes
First seen:2022-05-23 17:58:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 3072:AfY/TU9fE9PEtu22bTj/eZsl2JhPa0TeYFv8YARZ/KtWquoJTvJfS:WYa6LTkXPderR9KLLvJ
Threatray 13'755 similar samples on MalwareBazaar
TLSH T1CAE3F1147770E8A3F9731B71AE7597A6AFB2EA021875974F13202A9C3D91380DB1D713
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9cd8d8d47969f978 (4 x GuLoader)
Reporter SecuriteInfoCom
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Hovedbundens1 alerters SPORTELLNNEDE Bowenite
Issuer:Hovedbundens1 alerters SPORTELLNNEDE Bowenite
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-23T14:12:19Z
Valid to:2023-05-23T14:12:19Z
Serial number: -01b9b416a9e07a95
Thumbprint Algorithm:SHA256
Thumbprint: db0429d568507771a725f6e9bcca1523c3d67f56b97db4214d1703a8779161c1
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
320
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Gen.Variant.Nemesis.6939.7902.26603
Verdict:
Malicious activity
Analysis date:
2022-05-23 18:06:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5ea19d1d-69d3-4c00-8953-51b03e336451

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/273834/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Delayed reading of the file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/19735/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/628bcb6b054dcf0ecae41a84/reports/11b596ca-bf29-4d5e-a848-c671cc3a1260/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/27d2e9ce-bd63-48a4-bf9a-a0529dc98a6f
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1000106
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides threads from debuggers
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected GuLoader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 632606 Sample: SecuriteInfo.com.Gen.Varian... Startdate: 23/05/2022 Architecture: WINDOWS Score: 100 29 Found malware configuration 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected GuLoader 2->33 35 4 other signatures 2->35 7 SecuriteInfo.com.Gen.Variant.Nemesis.6939.7902.exe 1 33 2->7         started        process3 file4 21 C:\Users\user\AppData\Local\...\System.dll, PE32 7->21 dropped 23 C:\...\System.IO.UnmanagedMemoryStream.dll, PE32 7->23 dropped 37 Writes to foreign memory regions 7->37 39 Tries to detect Any.run 7->39 41 Hides threads from debuggers 7->41 11 CasPol.exe 15 11 7->11         started        15 CasPol.exe 7->15         started        17 CasPol.exe 7->17         started        signatures5 process6 dnsIp7 25 2.56.57.22 GBTCLOUDUS Netherlands 11->25 27 149.154.167.220 TELEGRAMRU United Kingdom 11->27 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->43 45 Tries to steal Mail credentials (via file / registry access) 11->45 47 Tries to harvest and steal ftp login credentials 11->47 53 3 other signatures 11->53 19 conhost.exe 11->19         started        49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->49 51 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->51 signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1be03967a615254ca0b3eba8b5aaa6b5f5c91c9f03d4fe2692b3675f93c0b26d/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-23 15:06:44 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpqdsz5gcusuzift5oullkvgwx24she7apkp4juswntv7e6awjwq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
05d4b6fb977b10ac13de1711ff83419415b730c99fc463d7159111418b64b702
GuLoader
06139d63dd6245a7ddc44c5d812a80da0b23b984c42fde376465238cb4430064
GuLoader
06bdd4b6e0c9bfc483091774c2bff1763b330baa8257f59dddcd56aeafb92d58
GuLoader
23b5df2d469238921bc4292d4ad2f179d57b19eba17a93c37af5d3ccae03f1c0
GuLoader
2bdd4101f8e038054ae6a169fde832f151b5f9902aac72e62e83416b023963ea
GuLoader
76ff37e66c52f5b613920fff3dfd22e300fe8bdd228baf76b843f198195680f7
GuLoader
da3208711d472f6c9af1141faa1272cab7b80cbaef1cfe0c24c5b1597f7a0c99
GuLoader
e6373eddd3eea61d770a921ee1f63f43145fafef60b2303bb8d2633a895f6b86
GuLoader
+ 13'745 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:guloader collection downloader keylogger spyware stealer suricata trojan
Link:
https://tria.ge/reports/220523-wj5y7saad8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks QEMU agent file
Loads dropped DLL
AgentTesla
Guloader,Cloudeye
suricata: ET MALWARE Generic .bin download from Dotted Quad
Malware Config
C2 Extraction:
https://api.telegram.org/bot1977970812:AAHd8pA2REAwdAB_6eJ-9nZj90oz8OYGjrI/sendDocument
Unpacked files
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/2ad7f2d4-38ba-4fb4-bab0-6e98db2662f6/
SH256 hash:
20fe645109c35b4986e2e6f676fd7df1407f0ccb770c792b0873f10a7979d4fc
MD5 hash:
71157490ed18b3df8e64f6213d366b0e
SHA1 hash:
4a161bed8c98ead10bec27ae4868a7a23c3a053a
Link:
https://www.unpac.me/results/2ad7f2d4-38ba-4fb4-bab0-6e98db2662f6/
SH256 hash:
1be03967a615254ca0b3eba8b5aaa6b5f5c91c9f03d4fe2692b3675f93c0b26d
MD5 hash:
09d431a8321ec75d7ff057787c319897
SHA1 hash:
b709d7968897d774676194b9708f304a6a472086
Link:
https://www.unpac.me/results/2ad7f2d4-38ba-4fb4-bab0-6e98db2662f6/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1be03967a615/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/1be03967a615254ca0b3eba8b5aaa6b5f5c91c9f03d4fe2692b3675f93c0b26d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/273834/

Comments