MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4710edc648f88ffd10f8b91116426c5ea2de81b6dfffc7866469d22f55d58a14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4710edc648f88ffd10f8b91116426c5ea2de81b6dfffc7866469d22f55d58a14
SHA3-384 hash: 5487cce97bc30c64570f6bb274e41b16d98c6fd6326ca374df3a77c70c0dfdad4d04a0b85e816a44cade19ec7576ede3
SHA1 hash: adbcb680b8d31d27f3217b31702885f5a370d389
MD5 hash: 150e113f574fd787341064493e7162dc
humanhash: sad-chicken-colorado-video
File name:DOWÓD WPŁATY.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:635'344 bytes
First seen:2023-02-11 09:40:39 UTC
Last seen:2023-02-11 11:54:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (388 x GuLoader, 59 x RemcosRAT, 44 x VIPKeylogger)
ssdeep 12288:Mbif/mHZzu6uhuQgRN6Zuj90Z2upnD4Ntx0cbHmTJSH9GyMJ:Oif/mHZzutuQgHt90TnD4N4cS0EyMJ
Threatray 228 similar samples on MalwareBazaar
TLSH T141D401A9FB10E40BD95A0B381C85D1685A20BD803D64D953B7E3BFAF7F7A1D3741418A
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 70c88c8c8c8ccc79 (9 x GuLoader, 1 x AgentTesla)
Reporter abuse_ch
Tags:exe geo GuLoader POL signed

Code Signing Certificate

Organisation:Pretangibly
Issuer:Pretangibly
Algorithm:sha256WithRSAEncryption
Valid from:2022-03-09T16:36:52Z
Valid to:2025-03-08T16:36:52Z
Serial number: -32bd9fb99586d8ed
Thumbprint Algorithm:SHA256
Thumbprint: bbe7f2f34fecc9e788bd993f784113ecd6160fdef2b5521c373672e2c0eaa97a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DOWÓD WPŁATY.exe
Verdict:
Malicious activity
Analysis date:
2023-02-11 09:44:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1e41ec4a-c6a3-4cd8-b8b7-2d50d042fbb5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/363902/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.65425425.23927.26117.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file
Creating a file in the %temp% subdirectories
Delayed reading of the file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/68062/overview
Behaviour
MalwareBazaar
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4710edc648f88ffd10f8b91116426c5ea2de81b6dfffc7866469d22f55d58a14
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5d4e65fd-24e4-4838-8fa9-7793e5af7029
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1171949
Signature
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 804739 Sample: DOW#U00d3D WP#U0141ATY.exe Startdate: 11/02/2023 Architecture: WINDOWS Score: 100 22 googlehosted.l.googleusercontent.com 2->22 24 drive.google.com 2->24 26 doc-14-9g-docs.googleusercontent.com 2->26 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected GuLoader 2->34 36 Yara detected AgentTesla 2->36 8 DOW#U00d3D WP#U0141ATY.exe 4 27 2->8         started        signatures3 process4 file5 20 C:\Users\user\AppData\Local\...\System.dll, PE32 8->20 dropped 38 Writes to foreign memory regions 8->38 40 Tries to detect Any.run 8->40 12 CasPol.exe 11 8->12         started        16 CasPol.exe 8->16         started        signatures6 process7 dnsIp8 28 googlehosted.l.googleusercontent.com 142.250.185.193, 443, 49834 GOOGLEUS United States 12->28 30 drive.google.com 172.217.18.110, 443, 49832 GOOGLEUS United States 12->30 42 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->42 44 Tries to steal Mail credentials (via file / registry access) 12->44 46 Tries to harvest and steal browser information (history, passwords, etc) 12->46 48 Tries to detect Any.run 12->48 18 conhost.exe 12->18         started        50 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->50 52 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 16->52 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4710edc648f88ffd10f8b91116426c5ea2de81b6dfffc7866469d22f55d58a14/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-02-09 07:55:42 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
18 of 39 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i4io3rsi7ch72ehyxeirmqtml2rn5anw3774pbtenhjc6vovrika._file
Verdict:
malicious
Similar samples:
012cdac9c7fabd82e1be72dcacb79bd73fabdef7bd148f4f1035943e5882270b
GuLoader
2481fd6c5d237aea74644564492f05998b436ab51fb2730310f4049a53ba5459
GuLoader
448234787d7924280fedbb49f5702f0483ef8046394f8adc14006f3f8b6793b2
GuLoader
67012c9555804fbfe82f17ee6d7d09196ed356053e2e778f49a998a4b718d6a6
GuLoader
691b3c73fa3301b9c36de80df0e7aa9d551a87ccc77a04b93786d6f1f5a41969
GuLoader
a81759cc686cbbf9946cc49e6bf06907532e57d9ff167e061e3993fb0c0fd1b7
GuLoader
ab2036dc90a503a003ed28e17ed2cf24001848be05580b6246656f88abe01c86
GuLoader
dd39027f02b3a47cb2677440f59575089a0673f134cff175d908be574ebc80ac
GuLoader
dfdedc4060f4944298bcdf25778b7f7eaaef43fdae61238d7debf88825e66294
GuLoader
efc035ff598957f35768f2d84721bbec76633c60538eda9d5ec53092f4384237
GuLoader
+ 218 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230211-lnrx2aed99/
Behaviour
Enumerates physical storage devices
Loads dropped DLL
Unpacked files
SH256 hash:
982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 hash:
0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 hash:
10c51496d37cecd0e8a503a5a9bb2329d9b38116
Link:
https://www.unpac.me/results/f277e3f3-5164-46ac-a870-7671d8873e58/
SH256 hash:
4710edc648f88ffd10f8b91116426c5ea2de81b6dfffc7866469d22f55d58a14
MD5 hash:
150e113f574fd787341064493e7162dc
SHA1 hash:
adbcb680b8d31d27f3217b31702885f5a370d389
Link:
https://www.unpac.me/results/f277e3f3-5164-46ac-a870-7671d8873e58/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4710edc648f88ffd10f8b91116426c5ea2de81b6dfffc7866469d22f55d58a14

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 4710edc648f88ffd10f8b91116426c5ea2de81b6dfffc7866469d22f55d58a14

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/363902/

Comments