MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5df23fef2c4355e6e4482c68011cfddbe754f1f8359fd7f6b9d2693b65110abf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5df23fef2c4355e6e4482c68011cfddbe754f1f8359fd7f6b9d2693b65110abf
SHA3-384 hash: c96204e80906ba565fbdadbef0b2933fe984041e2f31ce18aa94c13330bbeea491a7d271de10b6fa282348e3911b99f4
SHA1 hash: a382c7bf6a415cf977bbb2eba9c570a3ed5a809d
MD5 hash: b5310638979ca9ff8512c206b253a069
humanhash: oklahoma-stairway-delaware-wisconsin
File name:vbc.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:558'896 bytes
First seen:2022-08-31 08:16:23 UTC
Last seen:2022-08-31 08:45:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f23f452093b5c1ff091a2f9fb4fa3e9 (276 x GuLoader, 37 x RemcosRAT, 23 x AgentTesla)
ssdeep 6144:Rp+ggXJwbWkciVDkdDBCABfAy+uJybKNS9HmwzbYXNHgxiesGEsxKQzYkZtQK3Cf:nMJLIVYd9zfAy+uTN1wYXFwJB04YNWvE
TLSH T165C412753100E921EDBDC571AD2BC16ADB913E382D60269B3684F7AE3DF2322D50DB09
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 717169d496e0cccc (6 x GuLoader)
Reporter madjack_red
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:caracul shins
Issuer:caracul shins
Algorithm:sha256WithRSAEncryption
Valid from:2022-03-01T07:11:27Z
Valid to:2025-02-28T07:11:27Z
Serial number: -3d3439f1a63548ea
Thumbprint Algorithm:SHA256
Thumbprint: b16ec663b7806bb4a0a8af064c5a30b3bb83a198746ad45bd13941e0177cc7d9
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
243
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/306746/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.61613169.1030.4821.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Delayed reading of the file
Searching for the window
Searching for the Windows task manager window
Launching a process
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/36129/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/630f1a57ab0be91dfea32929/reports/a9f581d7-ddb5-4175-8f13-40c9aa977206/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1061419
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5df23fef2c4355e6e4482c68011cfddbe754f1f8359fd7f6b9d2693b65110abf/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Suspicious
First seen:
2022-08-30 14:41:56 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lxzd73zmink6nzcifruachh53ptvj4pygwp5p5vz2jutwzirbk7q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220831-j6pjhsdad4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Uses the VBS compiler for execution
Unpacked files
SH256 hash:
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 hash:
75ed96254fbf894e42058062b4b4f0d1
SHA1 hash:
996503f1383b49021eb3427bc28d13b5bbd11977
Link:
https://www.unpac.me/results/7a38bc62-e501-4623-a3d0-fdaaa95dbfc2/
SH256 hash:
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6
MD5 hash:
3d366250fcf8b755fce575c75f8c79e4
SHA1 hash:
2ebac7df78154738d41aac8e27d7a0e482845c57
Link:
https://www.unpac.me/results/7a38bc62-e501-4623-a3d0-fdaaa95dbfc2/
SH256 hash:
bb7e367bee3e91651d444db3c2f0997de914650547c66473bb201a2724d49196
MD5 hash:
6ea4aa54a7837e790c0b822dc8c27cd6
SHA1 hash:
1ed173163c496c482b36ef737fb6832e2b82cb6e
Link:
https://www.unpac.me/results/7a38bc62-e501-4623-a3d0-fdaaa95dbfc2/
SH256 hash:
5df23fef2c4355e6e4482c68011cfddbe754f1f8359fd7f6b9d2693b65110abf
MD5 hash:
b5310638979ca9ff8512c206b253a069
SHA1 hash:
a382c7bf6a415cf977bbb2eba9c570a3ed5a809d
Link:
https://www.unpac.me/results/7a38bc62-e501-4623-a3d0-fdaaa95dbfc2/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/306746/

Comments