MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d6ae0a40fcc30fab170c3e70dd5076253ddf9fa6ec0886d39cffbd9df99ae52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d6ae0a40fcc30fab170c3e70dd5076253ddf9fa6ec0886d39cffbd9df99ae52
SHA3-384 hash: b64c18a615588c684e4f2b912387c86ad8139311235f894356c0b8c0f778ee558d3ff1b1741520fe4221b87646b4b6bd
SHA1 hash: 7be95d03db43540b35017785169282dece4ff0d7
MD5 hash: 6fdcd23a0e0164e2c53ea690e900008a
humanhash: jig-hamper-single-jupiter
File name:Technical Datasheet.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:456'912 bytes
First seen:2023-06-13 06:35:30 UTC
Last seen:2023-06-13 06:43:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 12288:ZFzEa1fx9gBnxLvqrHTR1ghgNewsvftfG3:3EaBHgBxLvqrHlx4dvJ0
Threatray 1'047 similar samples on MalwareBazaar
TLSH T195A4F15A3564C273C915A4F3986A8986ABB47D29054C8F07376DBB8E1C7229FFC0E35C
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 7169696979796961 (1 x GuLoader, 1 x AgentTesla)
Reporter cocaman
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2023-05-24T02:54:08Z
Valid to:2026-05-23T02:54:08Z
Serial number: 64f8d9a87157454b53c4b91862467b8d59b58378
Thumbprint Algorithm:SHA256
Thumbprint: 4a87e206bb52bc7894e68537bb80e8c4d808c72f65f4eebef61263e258fe1f69
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
5
# of downloads :
278
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Technical Datasheet.exe
Verdict:
Malicious activity
Analysis date:
2023-06-13 06:40:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c80be750-f74b-4399-925c-59b4f54faa37

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/398139/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Tnega.SM.MTB.17302.10090.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/90412/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/64880e559f45f940f553b5c2/reports/197d1f20-d92e-447f-bc71-266baac1d456/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/4d6ae0a40fcc30fab170c3e70dd5076253ddf9fa6ec0886d39cffbd9df99ae52
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1ac097b0-e88a-4d9e-9c4d-ffca63a48ff0
Result
Threat name:
GuLoader, AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1253393
Signature
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 886413 Sample: Technical_Datasheet.exe Startdate: 13/06/2023 Architecture: WINDOWS Score: 100 28 zvejurumai.lt 2->28 30 api4.ipify.org 2->30 32 api.ipify.org 2->32 38 Multi AV Scanner detection for submitted file 2->38 40 Yara detected GuLoader 2->40 42 Yara detected AgentTesla 2->42 44 2 other signatures 2->44 8 Technical_Datasheet.exe 1 43 2->8         started        signatures3 process4 file5 24 C:\Users\user\AppData\...\SDRTCPRM.dll, PE32 8->24 dropped 26 C:\Users\user\AppData\Local\...\System.dll, PE32 8->26 dropped 46 Writes to foreign memory regions 8->46 48 Tries to detect Any.run 8->48 12 CasPol.exe 15 11 8->12         started        16 CasPol.exe 8->16         started        18 CasPol.exe 8->18         started        20 CasPol.exe 8->20         started        signatures6 process7 dnsIp8 34 api4.ipify.org 104.237.62.211, 443, 50131 WEBNXUS United States 12->34 36 zvejurumai.lt 79.98.26.13, 443, 50130 RACKRAYUABRakrejusLT Lithuania 12->36 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->50 52 Tries to steal Mail credentials (via file / registry access) 12->52 54 Tries to harvest and steal browser information (history, passwords, etc) 12->54 56 Tries to detect Any.run 12->56 22 conhost.exe 12->22         started        58 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->58 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d6ae0a40fcc30fab170c3e70dd5076253ddf9fa6ec0886d39cffbd9df99ae52/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-06-12 11:11:29 UTC
File Type:
PE (Exe)
Extracted files:
76
AV detection:
11 of 37 (29.73%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jvvobjapzqypvmlqyptq3vihmjj536p2n3aiq3jzz755tx4zvzja._file
Verdict:
unknown
Similar samples:
14ae647473cbf4def9becdbbb1f007fd8c96c63be5c88014415ab13e6467168f
GuLoader
151fb5746b08b95408b92e08f4bbeac8c4a1a3fc3ad6f43d237357f10476b33f
GuLoader
68ecb3a0784bbfd4ac9f3d1c76cfc09cff02b4298839e2e1b293e9ef8833b265
GuLoader
79e1fc85396ae65e8431f8ceb92fefb5ec396381840d830c415ea2d81cb78a49
GuLoader
959fc8883e6b1d4ab77f9738792435e2dae1969530f36d2672db6cb397778687
GuLoader
96c459f3f71ca66620515448f8dfa12c67d8b3e020776c93ccda641cce782ad6
GuLoader
9c3860c6744d8b2718e1109e327795014997a81b0e21706a96242d0f8d52f55b
GuLoader
a1662b8e9f60ae12d014dc7bf567d136abef56c45d76b65c765c71d411c7ee8f
GuLoader
d0294bc11b1c8e0655189aba2ade4ffb54da6f36e2afc2ef2e0045a5a17203bf
GuLoader
ef66ea0bcee19ccd3d2771a170ff218a3e43b27f1b18f24e08685cb4d3fe053a
GuLoader
+ 1'037 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:guloader collection downloader keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230613-hcxglaff9s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks QEMU agent file
Loads dropped DLL
AgentTesla
Guloader,Cloudeye
Unpacked files
SH256 hash:
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 hash:
0063d48afe5a0cdc02833145667b6641
SHA1 hash:
e7eb614805d183ecb1127c62decb1a6be1b4f7a8
Link:
https://www.unpac.me/results/fa64af36-657e-4464-a802-de7d7053a841/
Parent samples :
5312214b15330113f6eab71565e1e3c7d1ee3b59daa6703c271aaf3b192e6809
02fca6ef5d9d8b1eb29f7ac8ea0573b504ea7f06c215e091791653b40fe1329a
cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427
045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee
f2a883a0e4b01c72b0f063df3be5a0102e5c8fbaedc39c8d35c632b200599283
dffefbde27442b9095388b1871ffdc101c430b9a814138be4f962328a5b73fde
e0fb60da371912c158861c9660632d58e45cfcff12351cc9e03f497f319eb5de
904f69a4bed3844273cce1676e8920794815af4c1527e560bbc1bc44b5b8457a
SH256 hash:
223d24baa5f47814cd176aeef5dae0f8cbd974907fbe620a77bc59154a5244fb
MD5 hash:
42a17d83790648ea14596ea743f6fcf0
SHA1 hash:
bbd6efdf9ccd8ddccd86b78379100be162c5d4e6
Link:
https://www.unpac.me/results/fa64af36-657e-4464-a802-de7d7053a841/
SH256 hash:
4d6ae0a40fcc30fab170c3e70dd5076253ddf9fa6ec0886d39cffbd9df99ae52
MD5 hash:
6fdcd23a0e0164e2c53ea690e900008a
SHA1 hash:
7be95d03db43540b35017785169282dece4ff0d7
Link:
https://www.unpac.me/results/fa64af36-657e-4464-a802-de7d7053a841/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4d6ae0a40fcc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4d6ae0a40fcc30fab170c3e70dd5076253ddf9fa6ec0886d39cffbd9df99ae52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

7z 53a2d0ec8a38be05a6e1ad025ea2a0d3cc483ed60f35a572b0fcf8977a805f02

GuLoader

Executable exe 4d6ae0a40fcc30fab170c3e70dd5076253ddf9fa6ec0886d39cffbd9df99ae52

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 53a2d0ec8a38be05a6e1ad025ea2a0d3cc483ed60f35a572b0fcf8977a805f02
Cape
Cape
https://www.capesandbox.com/analysis/398139/
  
Dropped by
MD5 7dce6bf2d8631a69ccb35b0f708b7cd1

Comments