MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48b182b6f84f85278909eb70d8821812630a3c87f6c52d9e8c90adbf0e7b2ffe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48b182b6f84f85278909eb70d8821812630a3c87f6c52d9e8c90adbf0e7b2ffe
SHA3-384 hash: bdb557048788b4c852b7c75446cf3916f147ac68fb17b384c69f036ec1de03c44689805f7ab6aa0a0688d552fef0601f
SHA1 hash: 6e7d114ecd8616b482b29d3f71055f1e929c5d48
MD5 hash: 6bb15f6eca733f0dc46788990330debf
humanhash: table-football-gee-oxygen
File name:6bb15f6eca733f0dc46788990330debf.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'016 bytes
First seen:2021-05-28 19:11:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 534501dd9ce577814935581296a7adca (4 x GuLoader, 4 x RemcosRAT)
ssdeep 768:oMdlS5gAZIbbN8c0914vOK5/H0Q/W2J0Qs9RzSQODcD5Emf6SJhNjWRK4vwE+B:HdlS6AObbK11YUSTTQmM50+PV
Threatray 1'594 similar samples on MalwareBazaar
TLSH 1D834A39BAA0B77CE38047B05E7AD1BC69313C3C7DA16D56E74B31285EE7818A219353
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu/MEKI%20NEW%20START_pnZKRVHjmm91.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6bb15f6eca733f0dc46788990330debf.exe
Verdict:
Malicious activity
Analysis date:
2021-05-28 19:36:17 UTC
Tags:
trojan rat nanocore
Link:
https://app.any.run/tasks/d0b0f1b4-4c45-4dee-91e0-5a09d269d43b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/163042/
Detection(s):
Win.Dropper.Vebzenpak-9865056-0
Create hunting rule

Win.Trojan.Generickdz-9865268-0
Create hunting rule

Win.Trojan.Generickdz-9865275-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Sending a UDP request
DNS request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Creating a file in the %temp% directory
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NanoCoreRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5aae8185-ad8c-42c8-9ce1-e33ba800389c
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/794034
Signature
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 426432 Sample: PvUvVtMbqk.exe Startdate: 28/05/2021 Architecture: WINDOWS Score: 100 47 wywtrwbnmhtytrebsgwtfcvzcxgjhyegvbcnmgte.ydns.eu 2->47 53 Multi AV Scanner detection for domain / URL 2->53 55 Found malware configuration 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 6 other signatures 2->59 9 PvUvVtMbqk.exe 1 2->9         started        12 RegAsm.exe 4 2->12         started        14 dhcpmon.exe 4 2->14         started        16 dhcpmon.exe 3 2->16         started        signatures3 process4 signatures5 69 Writes to foreign memory regions 9->69 71 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 9->71 73 Tries to detect Any.run 9->73 75 2 other signatures 9->75 18 RegAsm.exe 1 20 9->18         started        23 RegAsm.exe 9->23         started        25 conhost.exe 12->25         started        27 conhost.exe 14->27         started        29 conhost.exe 16->29         started        process6 dnsIp7 49 wywtrwbnmhtytrebsgwtfcvzcxgjhyegvbcnmgte.ydns.eu 37.230.169.178, 2486 VOXILITYGB Netherlands 18->49 51 hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu 103.232.54.82, 49723, 80 AIMS-MY-NETAIMSDataCentreSdnBhdMY Viet Nam 18->51 41 C:\Users\user\AppData\Roaming\...\run.dat, ISO-8859 18->41 dropped 43 C:\Users\user\AppData\Local\...\tmp42AE.tmp, XML 18->43 dropped 45 C:\Program Files (x86)\...\dhcpmon.exe, PE32 18->45 dropped 61 Tries to detect Any.run 18->61 63 Hides threads from debuggers 18->63 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->65 31 schtasks.exe 1 18->31         started        33 schtasks.exe 1 18->33         started        35 conhost.exe 18->35         started        67 Uses schtasks.exe or at.exe to add and modify task schedules 23->67 file8 signatures9 process10 process11 37 conhost.exe 31->37         started        39 conhost.exe 33->39         started       
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/48b182b6f84f85278909eb70d8821812630a3c87f6c52d9e8c90adbf0e7b2ffe/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2021-05-26 20:40:14 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jcyyfnxyj6cspcij5nynraqycjrqupeh63cs3humscw36dt3f77a._file
Verdict:
suspicious
Similar samples:
0e312eccc907155b510e531e9519ede3e44ee79a67cb5dba0f3a0c39e9a3d083
GuLoader
250d4d5045162c39e3c1b9d637e0188089299a04106202afdf1f4826d24e27f4
GuLoader
26429a83373a49db5ad7801f324d8f1ce0aafd687ee405a44cb8d6ebebf65c15
GuLoader
815b5f62adb35607df07859bfd1b75763bf525643e7f21d5a0f8803dd0e86be4
GuLoader
8653a11ee811265418a3b6f12945c585b77aea72f02b2d80f481c1100d895299
GuLoader
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
GuLoader
9e3fdcc393fc96ce693041533b4ecc9e43d57ad1bca40c99d07713dc90d39bd4
GuLoader
a5fb63409bbc68224d3e2be7511cc6a49fd205892813890c3a76feeabd5a5e56
GuLoader
c63a3f86be406a11e8f7760403e407a97441753205f8cef432fd634856ca2992
GuLoader
fe3cb815b3ed9a0619d530afed14d2994514a66874e7e2446aed93586df566c4
GuLoader
+ 1'584 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:nanocore downloader evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210528-dbc62bhfws/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Checks QEMU agent file
Guloader,Cloudeye
NanoCore
Malware Config
C2 Extraction:
http://hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu/MEKI%20NEW%20START_pnZKRVHjmm91.bin
:2486
wywtrwbnmhtytrebsgwtfcvzcxgjhyegvbcnmgte.ydns.eu:2486
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/48b182b6f84f85278909eb70d8821812630a3c87f6c52d9e8c90adbf0e7b2ffe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 48b182b6f84f85278909eb70d8821812630a3c87f6c52d9e8c90adbf0e7b2ffe

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1283741/
  
URLhaus
https://urlhaus.abuse.ch/url/1293030/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/163042/

Comments