MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36e4352b2e4961e1ca1dd47baadf462af3e97fd0ebfb0c5694a5c6e22322c1c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	36e4352b2e4961e1ca1dd47baadf462af3e97fd0ebfb0c5694a5c6e22322c1c1
SHA3-384 hash:	3d4125e44d9163f44f3c4e1a7fcf242b52762a751bc0b8904449571511bbcee5543ad6d1dbd983d74f8359ea90360f6c
SHA1 hash:	5d00214f62f1ba1952d9aeeeb85472a044f27735
MD5 hash:	9eb7cad434dbfb7bb3e7e184df138c15
humanhash:	comet-idaho-zulu-berlin
File name:	Document.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	1'054'722 bytes
First seen:	2020-05-04 22:15:13 UTC
Last seen:	2020-05-05 05:45:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e453637f2317c3675b7b06b57403e87a (2 x RemcosRAT, 1 x GuLoader)
ssdeep	24576:cgTfvH5kDYtfLWyfhcEwyzd6TIk5ZtXsY:cgTffS1sOc6TIO
Threatray	921 similar samples on MalwareBazaar
TLSH	02257D22A253DA37C12355389D7F56B8E836BE136F6858472AF52C3C1EF93413837296
Reporter	abuse_ch
Tags:	Azure DHL exe GuLoader nVpn RAT

abuse_ch

Malspam distributing GuLoader:

HELO: sunn1.southcentralus.cloudapp.azure.com
Sending IP: 13.66.51.68
From: Dhl Customer Support <Support@dhl.com>
Subject: Order Delivery Failed
Attachment: Attachment.iso (contains "Document.exe")

GuLoader pushing RemcosRAT from drive.google.com

RemcosRAT C2s:
rex2018.hopto.org:2404
rex2018.myddns.me:2404
rex2020.myddns.me:2404
myb50.myddns.me:2404
johnhoff2.hopto.org:2404
jbcbeads.myddns.rocks:2404 (79.134.225.107)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Zusy.302747.15832.15474.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Delf

Status:

Malicious

First seen:

2020-05-04 22:36:28 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=g3sdkkzojfq6dsq52r52vx2gflz6s76q5p5qyvuuuxdoeizcyhaq._file

Verdict:

malicious

Label(s):

remcos

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-w7ef4wzqx6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Legitimate hosting services abused for malware hosting/C2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator