MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 201be9e9d833ee58b6bb7c14c864b6b97fa8d445d6f9eecae696670160dce8e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	201be9e9d833ee58b6bb7c14c864b6b97fa8d445d6f9eecae696670160dce8e1
SHA3-384 hash:	0e8adbecfaf621e753ebef13cc11a0d595b067c3500a2a3fd0ff65aca94bbe3dce6e7364160695dff25dd5bcabd909bc
SHA1 hash:	f9d47505f9253960f91eabfad4ff09b9481c3fc8
MD5 hash:	82ec2fb78e5553180492340afaf2d69f
humanhash:	iowa-single-fourteen-oklahoma
File name:	Purchase Order 1021234.gz
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	1'172'102 bytes
First seen:	2023-10-26 16:06:11 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	24576:9Ca3DLPUI7jqvncbGCBtGaPppWI1IQMZVcQgcXvQAk5bGvWodB:9RAI7jYeGeBpWCIVrg4toGuW
TLSH	T1C045333F7ADB1E18C3BED55636346E6895A432403376A9FCBD602C543E372840BB4E26
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	GuLoader gz

cocaman

Malicious email (T1566.001)
From: "Isabel Smit <sales@recyclanonwoven.com>" (likely spoofed)
Received: "from box.recyclanonwoven.com (box.recyclanonwoven.com [104.168.146.134]) "
Date: "26 Oct 2023 15:05:35 +0100"
Subject: "FW.RE:Order 2743"
Attachment: "Purchase Order 1021234.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

File Archive Information

This file archive contains 19 file(s), sorted by their relevance:

File name:	Purchase Order 1021234.scr
File size:	1'200'800 bytes
SHA256 hash:	90f4f826353051e2f4d26f43553e77312a00e6f4b05f1fa60b0d514d5d2fe895
MD5 hash:	b3d9364f55be3c17f33a68480e1a6547
MIME type:	application/x-dosexec
Signature	GuLoader

File name:	originals.hus
File size:	170'065 bytes
SHA256 hash:	acb948687bd0065d3c28a3ef1f5171402a8b7ceb680223e68499ca07a7fdf325
MD5 hash:	46645e396027e85064eb8e646190a732
MIME type:	application/octet-stream
Signature	GuLoader

File name:	Dobbeltfejl.sor
File size:	46'695 bytes
SHA256 hash:	f43bd0650a82ffe87607a6342df1da3b6ce6cd4fe3b494dd5a3ad1b5a37737f7
MD5 hash:	ea7e28ad7d2f5b84bbb801c98d1e377b
MIME type:	application/octet-stream
Signature	GuLoader

File name:	System.dll
File size:	12'288 bytes
SHA256 hash:	2d14e82ace016d0f0ee4fe29df6503955f6a77f3e705424427c1555411539a0e
MD5 hash:	61429bf00b8e34bd54c813bd2f5d09b9
MIME type:	application/x-dosexec
Signature	GuLoader

File name:	Unanointed.Sta
File size:	180'824 bytes
SHA256 hash:	8d75b2319e48cc4247773fdf105997ad7d33e9277cd6c711d5b31084fa7ca509
MD5 hash:	ee3617bd9227328f9765e793cfd3f600
MIME type:	application/octet-stream
Signature	GuLoader

File name:	cartelize.txt
File size:	377 bytes
SHA256 hash:	d26663e5727479dd27885c6c1d74b3d5068f5f692c0ce09e95ec1a4155ab26b6
MD5 hash:	0d9ad2c460b0a57ea2238cf11d374471
MIME type:	text/plain
Signature	GuLoader

File name:	velstandssamfund.pop
File size:	34'620 bytes
SHA256 hash:	b5308f2ec758c873bf0430e9a0f778bde788d6015ac80b76ea4ca8bf44e92055
MD5 hash:	b0b9bb4d20633cf29b69ee0e61beaf79
MIME type:	application/octet-stream
Signature	GuLoader

File name:	divertissant.min
File size:	193'877 bytes
SHA256 hash:	ed1139e9947a93b199b18ddb6dc2725f6e661157cb88b979948c1aabaddeea92
MD5 hash:	5c63a5598e8f9f3699c33be574dda1bd
MIME type:	application/octet-stream
Signature	GuLoader

File name:	Refragment.due
File size:	14'488 bytes
SHA256 hash:	992ce287c70a5ca631f4cbfc64b6292386e956b617709fb3f0fba8d840bef810
MD5 hash:	2ac711d9e99c664c6cc0781e3eec00f7
MIME type:	application/octet-stream
Signature	GuLoader

File name:	facetten.sum
File size:	186'969 bytes
SHA256 hash:	78b8cfd99d5e8bdd85714dcaceef385058f29c761d86267fff48376f5e41a767
MD5 hash:	dafd26cf828cae56dd176763627fa6b3
MIME type:	application/octet-stream
Signature	GuLoader

File name:	Bagbordssiders.kon
File size:	145'353 bytes
SHA256 hash:	38691adf9a3b969fea25cba314e6f8f20e62d4e89d4676b16636a191d425dccd
MD5 hash:	6cb29a00d5e33dffab8a515996e1ba6e
MIME type:	application/octet-stream
Signature	GuLoader

File name:	udstationeringer.doc
File size:	126'241 bytes
SHA256 hash:	f40dc6c856ba79308ca35f3c5afa076290dfe65d84b6787e310ca8080ebdd48f
MD5 hash:	5ffce199b97049fa2b15324fcd52b2a1
MIME type:	application/octet-stream
Signature	GuLoader

File name:	sniffly.tvr
File size:	136'126 bytes
SHA256 hash:	a0bc8bebd03ed87d5d899e5f65f48949b00c6e46b0e055a83e9ed2211db3e2aa
MD5 hash:	ee11b4e029a1f83151f0ffb2b0f56a87
MIME type:	application/octet-stream
Signature	GuLoader

File name:	Fermenteringers.cat
File size:	169'613 bytes
SHA256 hash:	c07eb1b59428faab267b5f1bfa2a9b53f1debf170b59915feaa985cc3a1ba221
MD5 hash:	a1c9d137fb9b8e476b54bcd763b442b1
MIME type:	application/octet-stream
Signature	GuLoader

File name:	impenetrabilities.str
File size:	51'717 bytes
SHA256 hash:	57535a49106d5e8543f53920144bedf57ba5bd405905e3fce85abf9a0ecc5083
MD5 hash:	789dae91f81eb7e882fef072b09eb882
MIME type:	application/octet-stream
Signature	GuLoader

File name:	branddrs.sta
File size:	39'909 bytes
SHA256 hash:	1b9a410f7e3794e026011aa84bfd2ba5f6edd60b810373044c8b56f7d6a5f123
MD5 hash:	ce57c7c7b225ce4a49ff057dc6cb1136
MIME type:	application/octet-stream
Signature	GuLoader

File name:	Colourtype11.boe
File size:	181'744 bytes
SHA256 hash:	85a08b55638b60bb8a4f9d38ed41e95b06f507b4f355e6583aa09d14dfaa6d59
MD5 hash:	47851ff3f432a7e92dd8ebea962c7157
MIME type:	application/octet-stream
Signature	GuLoader

File name:	Floriners199.tru
File size:	5'309 bytes
SHA256 hash:	33f63c3b7a256c190b7ea9376cf1e08a54967c349898ad7638cd7a8c20580ee5
MD5 hash:	383445822e58ccdd3f920d135c209844
MIME type:	application/octet-stream
Signature	GuLoader

File name:	Kror.aer
File size:	37'880 bytes
SHA256 hash:	9b3aca0373ef33db2890a13c9a8c01fcac697d92a1e159ed5174ecea59e79f73
MD5 hash:	d5df023c63eb7a3ee9060d78b7f43f5e
MIME type:	application/octet-stream
Signature	GuLoader

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control installer lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/653a8ea7bc703e36b08ee581/reports/d8a1b3d8-4cd3-4459-a545-3d4b11b71396/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/201be9e9d833ee58b6bb7c14c864b6b97fa8d445d6f9eecae696670160dce8e1

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/201be9e9d833ee58b6bb7c14c864b6b97fa8d445d6f9eecae696670160dce8e1/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ean6t2oygpxfrnv3pqkmqzfwxf72rvcf23465sxgsztqcyg45dqq._file

Result

Malware family:

guloader

Score:

10/10

Tags:

family:guloader downloader

Link:

https://tria.ge/reports/231026-t8sztseg88/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Loads dropped DLL

Guloader,Cloudeye

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

GuLoader

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/201be9e9d833ee58b6bb7c14c864b6b97fa8d445d6f9eecae696670160dce8e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.