MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 476bb9c473787445f22e5a80de8a48d0bb273817f0d25bec1c491f6fde8b1770. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 3

Intelligence 3 IOCs YARA 6 File information Comments

SHA256 hash:	476bb9c473787445f22e5a80de8a48d0bb273817f0d25bec1c491f6fde8b1770
SHA3-384 hash:	ead05d5e8f09c6a84c4ea8e6b8355b021d98ce7a50116ca0ad64c5cac299ff6b4bb4dc3f7b62ae490547fe731cf7b42b
SHA1 hash:	fa2ce57d7f09cbcb111b016a4cba22aa90177a68
MD5 hash:	bb5389e43dc0fc3296caaf3516603155
humanhash:	johnny-skylark-chicken-blossom
File name:	bb5389e43dc0fc3296caaf3516603155.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	122'880 bytes
First seen:	2020-05-26 10:55:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	73ec2b17fe6d13e0337a03d4dc61eedc (1 x GuLoader)
ssdeep	1536:lc7UlK+T1RmavGyPDKsU5jkgQLFZUNAx9O+/BEaxg6XZcxaY:lc7sK+TGYGyLqjb2Y+NxgrX
Threatray	624 similar samples on MalwareBazaar
TLSH	74C3F612B5D49D91FD018DB009639AF74D2BBC391E248F07B388BE4E163B68566F0B5E
Reporter	abuse_ch
Tags:	AsyncRAT exe GuLoader RAT

abuse_ch

GuLoader payload URLs:
https://drive.google.com/uc?export=download&id=1YGTTna5phVrxIO4Xj2UfIubib5FkjaLd
http://plututiso.ug/Host_BOoatbvhE36.bin
http://blockchains.pk/Host_BOoatbvhE36.bin

AsyncRAT payload URL:
http://plututiso.ug/ac.exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/4987/

Detection(s):

Win.Dropper.NetWire-7899317-0

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-26 06:56:49 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 31 (70.97%)

Threat level:

5/5

Verdict:

malicious

Label(s):

guloader

Result

Malware family:

n/a

Score:

6/10

Tags:

persistence

Link:

https://tria.ge/reports/201109-sast2es4ej/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Malicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	MAL_unspecified_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research

Rule name:	netwire Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research

Rule name:	Suspicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	win_asyncrat_j1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects AsyncRAT

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator