MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d4627af839c6b59921cd5aa0aac4c9231dd8ff72a3465521cf7c516e2283539. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2d4627af839c6b59921cd5aa0aac4c9231dd8ff72a3465521cf7c516e2283539
SHA3-384 hash:	a4e26fd898124f66f38b7cf262075bea6293b510c420531c6f40e5c968b71741ae37a44731b0fb505247da69fb2c23a0
SHA1 hash:	4972caf01831a2cbfb0d8e53e011170bfe0ca06c
MD5 hash:	0b359f7313105869be34d6abe847c38b
humanhash:	solar-michigan-rugby-zebra
File name:	SecuriteInfo.com.Trojan.Generic.33949365.25598.4632
Download:	download sample
Signature	Loki Alert Create hunting rule
File size:	414'247 bytes
First seen:	2023-06-21 10:30:52 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e2a592076b17ef8bfb48b7e03965a3fc (385 x GuLoader, 58 x RemcosRAT, 40 x AgentTesla)
ssdeep	6144:WpkXGhfZ2DXQfQDz+uImr8SbCp6Hs0Z0ku1LEhJXqgia4wclye433bFTW:vqugI2VOopP062nElye4HbFTW
TLSH	T11294CF22CB3C5D03E81475B5AD7396B3AAA45C644E7C494671EAFC3BF8282726F0D11E
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	SecuriteInfoCom
Tags:	exe Loki

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

322

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN guloader

Malware family:

guloader

Alert

Create hunting rule

ID:

1

File name:

SecuriteInfo.com.Trojan.Generic.33949365.25598.4632

Verdict:

Malicious activity

Analysis date:

2023-06-21 10:31:20 UTC

Tags:

guloader

Link:

https://app.any.run/tasks/69840efd-8228-4561-9549-4e5d4aa37c71

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Guloader

Detection:

Guloader

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/401275/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Generic.33949365.25598.4632.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% subdirectories

Sending a custom TCP request

Creating a file

Searching for the window

Creating a file in the %temp% subdirectories

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/91992/overview

Behaviour

MalwareBazaar

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lolbin masquerade overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/6492d169b453925d40730639/reports/a0db2b23-123a-46da-8450-c63b099dcc27/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/2d4627af839c6b59921cd5aa0aac4c9231dd8ff72a3465521cf7c516e2283539

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d9f4a4f1-67a1-41e6-b4c9-337041bd9d4a

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1258940

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2d4627af839c6b59921cd5aa0aac4c9231dd8ff72a3465521cf7c516e2283539/

ReversingLabs TitaniumCloud Win32.Trojan.Guloader

Threat name:

Win32.Trojan.Guloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-20 07:11:17 UTC

File Type:

PE (Exe)

Extracted files:

4

AV detection:

18 of 24 (75.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fvdcpl4dtrvvteq42wvavlcmsiy53d7xfi2gkuq467crnyrigu4q._file

Threatray cloudeye

Verdict:

malicious

Label(s):

cloudeye

Alert

Create hunting rule

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader discovery downloader

Link:

https://tria.ge/reports/230621-mkc55sgf79/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks installed software on the system

Checks QEMU agent file

Loads dropped DLL

Guloader,Cloudeye

UnpacMe 2

Unpacked files

SH256 hash:

2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

MD5 hash:

a4dd044bcd94e9b3370ccf095b31f896

SHA1 hash:

17c78201323ab2095bc53184aa8267c9187d5173

Link:

https://www.unpac.me/results/90c7f6d0-abfb-4d7c-9af7-5307d397fc79/

SH256 hash:

2d4627af839c6b59921cd5aa0aac4c9231dd8ff72a3465521cf7c516e2283539

MD5 hash:

0b359f7313105869be34d6abe847c38b

SHA1 hash:

4972caf01831a2cbfb0d8e53e011170bfe0ca06c

Link:

https://www.unpac.me/results/90c7f6d0-abfb-4d7c-9af7-5307d397fc79/

VMRay Lokibot

Malware family:

Lokibot

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2d4627af839c/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2d4627af839c6b59921cd5aa0aac4c9231dd8ff72a3465521cf7c516e2283539

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe 2d4627af839c6b59921cd5aa0aac4c9231dd8ff72a3465521cf7c516e2283539

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2668293/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/401275/