MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f
SHA3-384 hash: 1f5d6d9d78796982a672f617ff09d768e8e0c9d7dd2a1bacee84b959ce9d94017f35a30f562cc00a0a4b099c7e75a7e6
SHA1 hash: c169eb0ab2c50be64e06351363ea44b19839cb42
MD5 hash: be4cc819efcca915a682af25beb238de
humanhash: friend-lima-ten-michigan
File name:AWB 9869692024 Clearance Doc.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:760'400 bytes
First seen:2024-08-21 04:17:49 UTC
Last seen:2024-09-09 14:14:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3f91aceea750f765ef2ba5d9988e6a00 (45 x GuLoader, 9 x RemcosRAT, 7 x Loki)
ssdeep 12288:RS4njtlFI1cX06F4EQWq4tvsRn/zE6w2FxU1QgUVEnSFV:c4njtlTk67q4tvsRn/HFatnSv
Threatray 140 similar samples on MalwareBazaar
TLSH T16FF41288C1A4D0E2FC6236FC14257B0ECA796D54999D89D36BB47FDD81712A27F0FA02
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon b130fcd2d2d830a3 (6 x Formbook, 2 x RemcosRAT, 2 x njrat)
Reporter threatcat_ch
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Bevidsthedstabenes Stryger Octadic
Issuer:Bevidsthedstabenes Stryger Octadic
Algorithm:sha256WithRSAEncryption
Valid from:2024-05-29T07:32:35Z
Valid to:2027-05-29T07:32:35Z
Serial number: 59dd0f55b9bd5c2221a60dc382eb330df2f56c3c
Thumbprint Algorithm:SHA256
Thumbprint: 3e6857973d597b0d6fd4169a40fd37f7d0a65ae6ec926ac1dd4aca5633806abf
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
445
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
AWB 9869692024 Clearance Doc.exe
Verdict:
Suspicious activity
Analysis date:
2024-08-21 04:20:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/33f67cb6-8953-45a2-ba63-1899a0f7da7b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.FileRepMalware.18803.15267.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66c56a7ce7ff3f5a063baad2
Tags:
i n j e c t
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
installer lolbin microsoft_visual_cc overlay packed shell32
Link:
https://www.filescan.io/uploads/66c56a7bff28ddc140a0e7f1/reports/212203fd-7c75-4ba4-b421-b93fcb6749be/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/178bd201-d1c0-4b54-8dab-ca4413ca2993
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1496313
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected Remcos RAT
Found malware configuration
Installs a global keyboard hook
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2024-08-21 02:27:39 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dskfsq2h4cl7ef26aln6vsotdhdo7d3hggep6xp43antapqhqa7q._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
076efef63c51577044a06216c84e1acb0f70f8297fdf514e914fd8c25e2069d2
GuLoader
1619172a202b25aff96beb80b21fbda70ed92237a88a7a4d990f5de77b19677d
GuLoader
1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f
GuLoader
411d7a0d9d268daa710bbd8af48825e3227be7ed743c50c68afc05b71a940e83
GuLoader
c7fdd9b509804cf9e1d76b23a3d2c0f9529ec9e227b7e003f146d6d92f0aadb9
GuLoader
d379ffe32dfb2d6d386b6d9c3cbae49e49241ac25a14d2974c286bfa45aa50b9
GuLoader
+ 130 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:benchao discovery rat
Link:
https://tria.ge/reports/240821-ewyxzszbqe/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Remcos
Malware Config
C2 Extraction:
tochisglobal.ddns.net:6426
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d49bf212-9107-45d4-b85a-e03b2b26cd40
Unpacked files
SH256 hash:
f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
MD5 hash:
d6f54d2cefdf58836805796f55bfc846
SHA1 hash:
b980addc1a755b968dd5799179d3b4f1c2de9d2d
Link:
https://www.unpac.me/results/e4aaa382-9bb3-4ba6-93bd-5cfabbea3084/
SH256 hash:
507df75c959e1c9a89febb3f5d5963539895d9a602f4e6ca7898079919a83352
MD5 hash:
232f16c1cb21335fbce6f78ddaf2458c
SHA1 hash:
1c5981b852b3b640c98547074bda081c38859c3f
Link:
https://www.unpac.me/results/e4aaa382-9bb3-4ba6-93bd-5cfabbea3084/
SH256 hash:
1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f
MD5 hash:
be4cc819efcca915a682af25beb238de
SHA1 hash:
c169eb0ab2c50be64e06351363ea44b19839cb42
Link:
https://www.unpac.me/results/e4aaa382-9bb3-4ba6-93bd-5cfabbea3084/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1c94594347e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 1c94594347e097f2175e02dbeac9d319c6ef8f673188ff5dfcd81b303e07803f

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments