MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4384ad76060dd9c39eeb3d61bcc1e09f98240f9534e78f7aba99bba4091c98c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4384ad76060dd9c39eeb3d61bcc1e09f98240f9534e78f7aba99bba4091c98c3
SHA3-384 hash: 06e88462205ae5ded2d4cda3b0f5d837d6c31208083e8f973dbd3397ca4cc9e7319f25f0de105e00da2ba4f52d932498
SHA1 hash: 8aaeafdd73de23ec5037ab0b17395c6c44e47c5f
MD5 hash: 000d4ff0fd3d1bd184fef8583dd714e0
humanhash: august-comet-ack-king
File name:Drawing.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2021-06-30 13:20:01 UTC
Last seen:2021-06-30 13:52:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e3e4c9cae99340ffbee12b193d7b6357 (2 x GuLoader)
ssdeep 1536:t9ut5cAci+RrDNoK13F4hXvCWx1W/64JdTlKi9v/PdeEBoHUDiMJX:tR5i6NH3CFaWTWndUiqmeUDiA
Threatray 2'194 similar samples on MalwareBazaar
TLSH 5FA3D40275F38F1BD1A78A716B608D5FB29478FC59439D2742C5252A3AF6B0786B032F
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
210
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8aaeafdd73de23ec5037ab0b17395c6c44e47c5f
Verdict:
Malicious activity
Analysis date:
2021-06-30 08:46:40 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/0d41ebc1-1854-4873-9454-6b2bc1898efb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.__vbaHresultCheckObj.28086.31051.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c3a743c7-2aa3-402a-a7a0-c3da7d078ed1
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/809984
Signature
Antivirus detection for URL or domain
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
guloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4384ad76060dd9c39eeb3d61bcc1e09f98240f9534e78f7aba99bba4091c98c3/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-06-30 01:24:28 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iock25qgbxm4hhxlhvq3zqpat6mcid4vgtty66v2tg52ici4tdbq._file
Verdict:
suspicious
Similar samples:
37fba5e93049ee78ac1fdf1fafe945636680193ddcb1dc9533f2c9ac80d3744c
GuLoader
479f929625a3e8a8f98256c3a020f5946e0d88fd7e3582e47b63500679d46585
GuLoader
522735989689a96d0e10e926aae941e58a695062254573c5796bb129e4c7703e
GuLoader
6147decc439b9d258f5b19f77dfa47ea441e681c49e0b699533eea18104f4092
GuLoader
6670269c08d80b6511029d06dfa07711a5e0bb1494107da5dc9d9d5661f010f3
GuLoader
8b2596e73c754b0590b95e6245538874729bec5c62267719ef9bc8b9de21d01f
GuLoader
93ff33867e6593f0e5a80ba261665c6f162bceed6cb39362811a70aa6561cf11
GuLoader
c2544476ab17fd3fb816a97f08f16548a73c106cca80e1f5e185086d25a9f414
GuLoader
e0f53d67eb5d4a5bab2f6d0bbaff502896e12572b97bf0350c88cfac3fcc5b8f
GuLoader
fd5a380a446107f3648301abfefda6b5269ecc51ccf21fb850a8d70332ab962b
GuLoader
+ 2'184 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:guloader downloader keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210630-5d9mp89dk6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
Guloader,Cloudeye
AgentTesla
Malware Config
C2 Extraction:
http://2.56.59.212/RW.bin
https://api.telegram.org/bot1232219601:AAGi4YRRA0aCFmbSC-rMWUzrmPiQ1aaRuE0/sendDocument
Unpacked files
SH256 hash:
4384ad76060dd9c39eeb3d61bcc1e09f98240f9534e78f7aba99bba4091c98c3
MD5 hash:
000d4ff0fd3d1bd184fef8583dd714e0
SHA1 hash:
8aaeafdd73de23ec5037ab0b17395c6c44e47c5f
Link:
https://www.unpac.me/results/90746f55-5af7-42f0-b887-1fc133863312/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4384ad76060dd9c39eeb3d61bcc1e09f98240f9534e78f7aba99bba4091c98c3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments