MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ae6b9b8d5a28d2654eee377584df778fac3bf8b1bd89f653a862afc3cfaa5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30ae6b9b8d5a28d2654eee377584df778fac3bf8b1bd89f653a862afc3cfaa5f
SHA3-384 hash: 45730682ba8944498bb34b380322822ee2d7e7c897975ed6dac0725ddc2869ac8e3de777c81dfa00abc84afb44941902
SHA1 hash: 5ffd53ebdeebf9fd8f0bb4d2cefd5ea2873990f6
MD5 hash: c941847124228f920070346f9ef4de89
humanhash: fifteen-papa-moon-south
File name:30ae6b9b8d5a28d2654eee377584df778fac3bf8b1bd89f653a862afc3cfaa5f
Download: download sample
Signature GuLoader
Create hunting rule
File size:894'136 bytes
First seen:2024-04-04 11:08:52 UTC
Last seen:2024-04-04 11:32:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f23f452093b5c1ff091a2f9fb4fa3e9 (274 x GuLoader, 36 x RemcosRAT, 23 x AgentTesla)
ssdeep 12288:BIrQbs3XWa23C+iA6r40hIC8laDHZRwrbjECpC5JRSnZM6qIiqJdWWS:8uQXWj38A6rnr+C57wqIisDS
Threatray 279 similar samples on MalwareBazaar
TLSH T1581502427D43D565E85D1B31A86A8C150222BE24E9B8370FEFC8B77AF7F3291442A717
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter adrian__luca
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Mallangong
Issuer:Mallangong
Algorithm:sha256WithRSAEncryption
Valid from:2024-03-09T07:47:30Z
Valid to:2027-03-09T07:47:30Z
Serial number: 11988f2685ea389a76b05aac8d35ece0f2d44252
Thumbprint Algorithm:SHA256
Thumbprint: 94e9b8a3655287ca339a1da209a7a9417fd1c0b13c5f5213ea8626d804d69675
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
318
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
c941847124228f920070346f9ef4de89.exe
Verdict:
Malicious activity
Analysis date:
2024-03-15 04:21:32 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/e12c2182-c997-4e3e-9af2-748e9ff695b7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Launching a process
Running batch commands
Using the Windows Management Instrumentation requests
Moving a file to the Program Files subdirectory
Replacing files
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/660e8a5abb285b5db056ac87/reports/147a894f-cd28-4c09-81b8-5252ea2f8a67/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/30ae6b9b8d5a28d2654eee377584df778fac3bf8b1bd89f653a862afc3cfaa5f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8d0a11fc-9d43-4007-b00b-a5cfb215a049
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1420097
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Powershell drops PE file
Suspicious powershell command line found
Writes to foreign memory regions
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/30ae6b9b8d5a28d2654eee377584df778fac3bf8b1bd89f653a862afc3cfaa5f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30ae6b9b8d5a28d2654eee377584df778fac3bf8b1bd89f653a862afc3cfaa5f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-03-15 06:10:57 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
24 of 38 (63.16%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gcxgxg4nliunezko5y3xlbg7o6h2yo7ywg6yt5stvbrk7q6pvjpq._file
Verdict:
malicious
Similar samples:
086fd488622c16461d2c60ca3cd42a7d5147978f1624e51a04c7ceedcaa71c6c
GuLoader
0b8154e3905fe82a62732791895e0510c240067b97f5ddf4edee2b10f2e984ad
GuLoader
19593fb0eb17b04d214f834a817caebadd4ea02b52d6a0fb913aa7e80adfaa91
GuLoader
33d004dfe611ea39e022f1373189184c9bbc5866eccdf2ada38a794fbe717fc6
GuLoader
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34
GuLoader
4468fe52ea5aeb3bb0673ea101f9989fe4a1ea3ee8f729c64f56f66324e94988
GuLoader
5fd79e8094fb1ac9dbc167219bc3218cf07a5679edc11f7847c5cd0b2e756309
GuLoader
977965787ace76ed2ef7b9d8923958c46ceaefa46ec09ad2436f4b22b1b42513
GuLoader
98ac0a744497cf22f08ae5e2e49eba547253f7824b2a76ecfd7cf786dd1b34ce
GuLoader
b0dc753528fac2e75ebae213fad9d05ba85cf9f37858feda945d2eff47979e28
GuLoader
+ 269 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader persistence
Link:
https://tria.ge/reports/240404-m84yrsdc2y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Guloader,Cloudeye
Unpacked files
SH256 hash:
30ae6b9b8d5a28d2654eee377584df778fac3bf8b1bd89f653a862afc3cfaa5f
MD5 hash:
c941847124228f920070346f9ef4de89
SHA1 hash:
5ffd53ebdeebf9fd8f0bb4d2cefd5ea2873990f6
Link:
https://www.unpac.me/results/fc7acf06-bb9b-4275-b917-79064b059848/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/30ae6b9b8d5a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/30ae6b9b8d5a28d2654eee377584df778fac3bf8b1bd89f653a862afc3cfaa5f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileExW
KERNEL32.dll::MoveFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments