MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 525ac0be035eb5b99e8de21ae809abcea86590bd9f122dbf6454274134708f81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	525ac0be035eb5b99e8de21ae809abcea86590bd9f122dbf6454274134708f81
SHA3-384 hash:	4bd100b9f0bb9b17e4c7fa74e0adb7d7d4a4704dfbcdbea95514220d2e80d2b35f4784f552665ea5406972181c0e9e7e
SHA1 hash:	24ad280eda6ac1adb1cf02097907cc83330312d3
MD5 hash:	4fc3c7bb92ff2a8b9a8abf571921d144
humanhash:	coffee-kansas-zulu-burger
File name:	525ac0be035eb5b99e8de21ae809abcea86590bd9f122dbf6454274134708f81
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	560'643 bytes
First seen:	2023-10-10 13:33:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (557 x GuLoader, 120 x RemcosRAT, 82 x EpsilonStealer)
ssdeep	12288:jVKoEMFDen1xUv/PZ/Dd55UZ6HzuuSAzoCS5njax8B:j8yDen3Uv/Phd5WZ6TuRAzpInos
Threatray	471 similar samples on MalwareBazaar
TLSH	T156C4F1E16633CC53F1208B32D41ADEB94763ED066637C39B2355FE6A38ABF12790A115
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	a0abababababa064 (1 x GuLoader)
Reporter	adrian__luca
Tags:	exe GuLoader

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

284

Origin country :

HU

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

525ac0be035eb5b99e8de21ae809abcea86590bd9f122dbf6454274134708f81

Verdict:

Malicious activity

Analysis date:

2023-10-10 15:09:55 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/641d5fd7-40d6-4f27-ad11-1a91ad3312b8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Siggen8.40546.2143.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file

Creating a file in the %temp% directory

Delayed reading of the file

Dragonfly

Gathering data

FileScan.io

Gathering data

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/525ac0be035eb5b99e8de21ae809abcea86590bd9f122dbf6454274134708f81

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7aa6e138-666f-4269-b418-75a7b83115a8

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1322967

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/525ac0be035eb5b99e8de21ae809abcea86590bd9f122dbf6454274134708f81/

ReversingLabs TitaniumCloud Win32.Trojan.Guloader

Threat name:

Win32.Trojan.Guloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-14 00:12:16 UTC

File Type:

PE (Exe)

Extracted files:

6

AV detection:

20 of 38 (52.63%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kjnmbpqdl223thun4inoqcnlz2uglef5t4jc3p3ekqtucndqr6aq._file

Threatray malicious

Verdict:

malicious

Similar samples:

5b71ca8477aec239a3024551bfadd54156121e3cb394509d0642241048fc2b83

GuLoader

666f6668173354a8778b1d470f245c39116b67ad41e15d16b99d9ef69d794185

GuLoader

89599ae785aa5f919018882cd10534cbae8ac89047ebbeda0b232d52fa545944

GuLoader

b0fb2b621554e7ec448b02a2a0fd62e4930db4625dee899b52d20aa2c9a457ad

GuLoader

bc7dad4c86fbdbe3bc632b5aa8c75b3719ec38aa70ec63bb55845752efd01350

GuLoader

d1c0a7043a069e8e3c7e63d87c918d0613be1e4c6c1d0fe4fd05addbfe4367fa

GuLoader

db95b1fd14afe70b52d79131a53865993353ccfc5070146615a7c4f1a115d1bb

GuLoader

e9e52f7f7442fd3bf5330794843a393c1b2e4e0fd462a153daaf89e4d1109d27

GuLoader

+ 461 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231010-qthzjafg39/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks QEMU agent file

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

MD5 hash:

0d7ad4f45dc6f5aa87f606d0331c6901

SHA1 hash:

48df0911f0484cbe2a8cdd5362140b63c41ee457

Link:

https://www.unpac.me/results/9724de13-7b8d-4b21-b816-f88cd686ba3e/

SH256 hash:

525ac0be035eb5b99e8de21ae809abcea86590bd9f122dbf6454274134708f81

MD5 hash:

4fc3c7bb92ff2a8b9a8abf571921d144

SHA1 hash:

24ad280eda6ac1adb1cf02097907cc83330312d3

Link:

https://www.unpac.me/results/9724de13-7b8d-4b21-b816-f88cd686ba3e/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.79

Link:

https://yomi.yoroi.company/submissions/525ac0be035eb5b99e8de21ae809abcea86590bd9f122dbf6454274134708f81