MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments

SHA256 hash:	23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f
SHA3-384 hash:	7883f071083cd0e86b77391e3793de67e4a4fb7f8d9b7a063341b962f58e8198a33cbabaffb2063a9164515caddc1881
SHA1 hash:	6427b2e160082bdb6a5b0213a3de348986f31530
MD5 hash:	ac900546c8bf5b3be3184502d0d2d7ba
humanhash:	ceiling-neptune-finch-twenty
File name:	Quote_220072.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	1'197'664 bytes
First seen:	2024-11-01 11:14:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3f91aceea750f765ef2ba5d9988e6a00 (45 x GuLoader, 9 x RemcosRAT, 7 x Loki)
ssdeep	24576:T4nhDoAFBOCmg1OJnkFWsksVBNF/ZNXLGQ7WczkxFnfbP97:T+hkcOCm+OWFW+V5BNXKQKczgt
Threatray	172 similar samples on MalwareBazaar
TLSH	T16F45232976A7C08FEA820A385AF7E33BD67AFD102D25852777602B4EFD3528CDD56110
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	threatcat_ch
Tags:	AgentTesla exe GuLoader signed

Code Signing Certificate

Organisation:	Selvbinderes
Issuer:	Selvbinderes
Algorithm:	sha256WithRSAEncryption
Valid from:	2024-07-22T02:29:52Z
Valid to:	2027-07-22T02:29:52Z
Serial number:	234bc0fc872a6a06c77e178a22ef69418c6ca6a1
Thumbprint Algorithm:	SHA256
Thumbprint:	c191c38e37d3b3a2571e1406691b55fc305d47268b0dc2b40cbb934a663afaec
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

446

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

Quote_220072.exe

Verdict:

Malicious activity

Analysis date:

2024-11-01 11:17:46 UTC

Tags:

stealer agenttesla exfiltration smtp

Link:

https://app.any.run/tasks/f59bea12-9401-498e-81aa-273d272bee3b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.Malware-gen.4401.640.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6724b83b8d23d9049132722e

Tags:

exploit uloader blic

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Creating a file

Searching for the window

Creating a file in the %temp% subdirectories

Delayed reading of the file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

installer microsoft_visual_cc overlay packed

Link:

https://www.filescan.io/uploads/6724b836d71e009bb1f881e7/reports/82912d3e-6ce1-4905-96dc-6b30fd14ce21/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a169b8f6-42fd-4442-9456-00a95dfc111a

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1546663

Signature

AI detected suspicious sample

Found malware configuration

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f/

Threat name:

Win32.Trojan.GuLoader

Status:

Malicious

First seen:

2024-10-30 10:27:57 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 38 (55.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eppwj6twfnmufueny27w6wx4ox6jgjizvfqhbl2jfyrxwvedor7q._file

Verdict:

malicious

Label(s):

cloudeye

GuLoader

1619172a202b25aff96beb80b21fbda70ed92237a88a7a4d990f5de77b19677d

GuLoader

411d7a0d9d268daa710bbd8af48825e3227be7ed743c50c68afc05b71a940e83

GuLoader

ad1f6b68331f1d4b983df1eddfea197f4a091e648528dc28c6016524b51d58b0

GuLoader

error

GuLoader

+ 162 additional samples on MalwareBazaar

Result

Malware family:

guloader

Score:

10/10

Tags:

family:agenttesla family:guloader collection discovery downloader keylogger spyware stealer trojan

Link:

https://tria.ge/reports/241101-nlz7qsylft/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Agenttesla family

Guloader family

Guloader,Cloudeye

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/863c98b4-259b-45c0-8e77-f7ad213d3947

Unpacked files

SH256 hash:

f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9

MD5 hash:

d6f54d2cefdf58836805796f55bfc846

SHA1 hash:

b980addc1a755b968dd5799179d3b4f1c2de9d2d

Link:

https://www.unpac.me/results/3e8abc0f-fabb-4212-8552-48285fc4d7f2/

SH256 hash:

23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f

MD5 hash:

ac900546c8bf5b3be3184502d0d2d7ba

SHA1 hash:

6427b2e160082bdb6a5b0213a3de348986f31530

Link:

https://www.unpac.me/results/3e8abc0f-fabb-4212-8552-48285fc4d7f2/

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/23df64fa762b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

exe 23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::SetFileSecurityW
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::SHFileOperationW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDiskFreeSpaceW KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::OpenClipboard USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample