🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda
SHA3-384 hash: e27f75d2e458a0018252db09c9fedb207d2368e9883f83f83d77bf567fe08f32317ff0d2abe8f46361b2f8993e0360f7
SHA1 hash: 24d30b606727d8739c0fcd8f5d0d6c76dfdf7a3c
MD5 hash: caef1be333db06e88325e3cf82c27fe1
humanhash: massachusetts-one-sierra-sink
File name:21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda
Download: download sample
Signature GuLoader
Create hunting rule
File size:623'864 bytes
First seen:2024-10-09 10:41:08 UTC
Last seen:2025-01-10 14:06:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f0c714c36e6cc016b3a1f4bc86559e4 (206 x GuLoader, 14 x Formbook, 4 x AgentTesla)
ssdeep 12288:n/v3K20gS7RPJddE9MVl01amNw3I372nX2ixR5dwG36OoZf+:n/CWS7XoKmNw3s2nh5dVKON
TLSH T153D412117660C66FE7391B344A77FA7E9678E88E3E6907073704BE6DB835280413E46E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon 80c4d6e69cc0f819 (1 x GuLoader)
Reporter adrian__luca
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Olycook Meddelelsernes Derivedness
Issuer:Olycook Meddelelsernes Derivedness
Algorithm:sha256WithRSAEncryption
Valid from:2024-01-18T11:27:14Z
Valid to:2027-01-17T11:27:14Z
Serial number: 1ae3ecf12bbe2cd6670c159c9180a38a275b776e
Thumbprint Algorithm:SHA256
Thumbprint: fd9b3d33e3e1f2289fc944f8d991d5afbb349da39c79e3bb1d870fd90b3f1de4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
376
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda
Verdict:
Malicious activity
Analysis date:
2024-10-09 10:41:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8d7b469f-f09e-4e81-8609-ad54441c44ec

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Trojan.Tedy-9957397-0
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67065dffab31793a7b20fdcf
Tags:
Powershell Nsis
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
installer lolbin microsoft_visual_cc overlay packed shell32 signed
Link:
https://www.filescan.io/uploads/67065dfc4d903f1f7eef643b/reports/a98cdd36-7caf-4958-ba8f-3a449a7e9a5c/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/28a03f7a-0da3-46b9-b75b-29d43e8a315b
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1529806
Signature
C2 URLs / IPs found in malware configuration
Detected Remcos RAT
Found malware configuration
Mass process execution to delay analysis
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Remcos
Switches to a custom stack to bypass stack traces
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1529806 Sample: pEva66LvYg.exe Startdate: 09/10/2024 Architecture: WINDOWS Score: 100 38 kezdns.pro 2->38 40 hlduplooyplant.co.za 2->40 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected GuLoader 2->50 52 3 other signatures 2->52 8 pEva66LvYg.exe 36 2->8         started        signatures3 process4 file5 34 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->34 dropped 36 C:\Users\user\AppData\Local\...\System.dll, PE32 8->36 dropped 54 Obfuscated command line found 8->54 56 Mass process execution to delay analysis 8->56 58 Switches to a custom stack to bypass stack traces 8->58 12 pEva66LvYg.exe 3 6 8->12         started        16 cmd.exe 8->16         started        18 cmd.exe 8->18         started        20 62 other processes 8->20 signatures6 process7 dnsIp8 42 kezdns.pro 85.17.23.154, 2404 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 12->42 44 hlduplooyplant.co.za 160.119.248.138, 443, 49738 xneeloZA South Africa 12->44 60 Detected Remcos RAT 12->60 22 Conhost.exe 16->22         started        24 Conhost.exe 18->24         started        26 Conhost.exe 20->26         started        28 Conhost.exe 20->28         started        30 Conhost.exe 20->30         started        32 59 other processes 20->32 signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2024-10-09 10:42:06 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eg6kh3jybl7zqe4lyjwmmmopvj7o3uey4pngstuo542qwi5pz3na._file
Verdict:
malicious
Label(s):
packer_bxor
Create hunting rule
cloudeye
Create hunting rule
Similar samples:
error
GuLoader
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:remotehost discovery downloader rat
Link:
https://tria.ge/reports/241009-mrnkfs1clj/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Guloader,Cloudeye
Remcos
Malware Config
C2 Extraction:
kezdns.pro:2404
Verdict:
Malicious
Tags:
loader guloader
YARA:
NSIS_GuLoader_July_2024
Link:
https://app.threat.zone/submission/35b64f98-6524-4576-a212-118eae7f3735
Unpacked files
SH256 hash:
c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 hash:
792b6f86e296d3904285b2bf67ccd7e0
SHA1 hash:
966b16f84697552747e0ddd19a4ba8ab5083af31
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
SH256 hash:
10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
MD5 hash:
5aa38904acdcc21a2fb8a1d30a72d92f
SHA1 hash:
a9ce7d1456698921791db91347dba0489918d70c
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
SH256 hash:
4d48a5aa95fc23dbad935b4aaa78b89f3a33dabb987e03f7d65e12196bd5c8ee
MD5 hash:
fa27c1624e9c26eb3db8a3021680cb42
SHA1 hash:
5e24d685b2dd8ce062141bee29a7f6c2ec7f37be
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
SH256 hash:
c861509e99478bddac671990f2bb1be9f0548deae51decca4c9a8a426b20eff7
MD5 hash:
bd80dd0401398aba0dffb8a14e6e68b9
SHA1 hash:
ff0c4d230a61166568cb4ff2fe36b9f88e6937e8
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
SH256 hash:
8bac2779397200f71de805c91e6be351c72e1471ef29a6f2e600012922c39b30
MD5 hash:
019b7c87bb2aea931caecc7a5f1694bd
SHA1 hash:
9b1683a6a4b29a3c5c7aa97c12b7c082fac7576e
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
SH256 hash:
e996e20636afbf3fe54dc4243f8b608ff5204a4dc565e52c45839afb51c07609
MD5 hash:
5b68fbb3dfa36b74ac622e6ebcb7d7f6
SHA1 hash:
0571d30e6f218e85d18b076a42623046f01bb6aa
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
SH256 hash:
a74fd54513a5fe20727d0fee051197a362ad327ece70da451975dfc25fdbd036
MD5 hash:
cdbe100abd390bc29ffc7d67dbde2022
SHA1 hash:
044f9478c96f14f89b5291e63fa7b1b9ea6f08ca
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
SH256 hash:
6afc379db09413c59646e9ca45ac098b578f4fee6010b716f1e09836979931df
MD5 hash:
dcff8de7950c55510edf7249fecfe57e
SHA1 hash:
332fefb8d064eb262a53749c3e0cf762af894917
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
SH256 hash:
21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda
MD5 hash:
caef1be333db06e88325e3cf82c27fe1
SHA1 hash:
24d30b606727d8739c0fcd8f5d0d6c76dfdf7a3c
Link:
https://www.unpac.me/results/39ea768e-dab4-48e9-8cbb-93c41f078602/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/21bca3ed380a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.58
Link:
https://yomi.yoroi.company/submissions/21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:NSIS_GuLoader
Create hunting rule
Author:NDA0E
Description:Detects GuLoader using NSIS
Rule name:NSIS_GuLoader_July_2024
Create hunting rule
Author:NDA0E
Description:Detects GuLoader packed with NSIS installer
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::SetFileSecurityA
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExA
SHELL32.dll::SHFileOperationA
SHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExA
KERNEL32.dll::GetDiskFreeSpaceA
KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileExA
KERNEL32.dll::MoveFileA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExA
USER32.dll::OpenClipboard
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments