MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e0716efef9b86fed46cec2da9116f481add142b65aeb45be6d16666ac583404. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e0716efef9b86fed46cec2da9116f481add142b65aeb45be6d16666ac583404
SHA3-384 hash: 530cf6803755717ca78f7a4bdb3ddd2db5d2074212745d3a64f67e035ab61fc966fba13e1c0266807a8777a785c7051c
SHA1 hash: 2f0fe3beb1d88074283c2234600edf6f37d43e5e
MD5 hash: 7502a82156bca60a8aadd2b3cc1ccfbe
humanhash: paris-undress-tennis-whiskey
File name:7502a82156bca60a8aadd2b3cc1ccfbe.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:184'320 bytes
First seen:2021-09-29 09:52:39 UTC
Last seen:2021-09-29 11:22:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 831c9926df4754b736e1ca092f4fb7e7 (5 x RemcosRAT, 1 x GuLoader)
ssdeep 3072:5T6TxJ486kf7WcznwUJEpL8jF0qUCK662nYyQjg+Yi:5TCBtzV0qtK6g
Threatray 5'739 similar samples on MalwareBazaar
TLSH T16D04C6496E78AC2DF1CA3DB4A865649913C63C03FB8452AE10D5F3FC76309EE6852B17
File icon (PE):PE icon
dhash icon 1003873d31213f10 (142 x DarkCloud, 132 x GuLoader, 35 x a310Logger)
Reporter abuse_ch
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7502a82156bca60a8aadd2b3cc1ccfbe.exe
Verdict:
No threats detected
Analysis date:
2021-09-29 10:30:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/270fee19-6ba5-4cab-904d-bf78297a5eb2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/193087/
Detection(s):
SecuriteInfo.com.Trojan.VbCrypt.2349.19234.15439.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b35383bc-1ff3-40bb-ad3a-9635b0a51814
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/860739
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
GuLoader behavior detected
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potential malicious icon found
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e0716efef9b86fed46cec2da9116f481add142b65aeb45be6d16666ac583404/
Threat name:
Win32.Trojan.Ursu
Create hunting rule
Status:
Malicious
First seen:
2021-09-29 09:53:28 UTC
AV detection:
16 of 45 (35.56%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
39de6e1f455747a1e878f070e5b62e306a60bd595d5a1840518cc07972a5c6d1
GuLoader
6147decc439b9d258f5b19f77dfa47ea441e681c49e0b699533eea18104f4092
GuLoader
628dfd34daff8a0bf381c3bdf5a106ed0de213d6aabfd68e3f3b2276afb0e58b
GuLoader
a33b31af132d492e1eb511ed37087a9c52af1f7dd575fa63634fa9b4170daaa7
GuLoader
ab2261ddf24d2524a3ffe99044fac988f6178be9bc78d28cd5db289c414c3a4f
GuLoader
ae83f208925ec791bd10f37e0cd1bfc98473ea586c4814288a243c7d579c2e55
GuLoader
bd6cf98ff23cdad2f5bb43bb60e61275d8ad1ad7baeb609aa0a812fc048fede0
GuLoader
ef634a53dfb00589d513ce13cc9332fef2749255093f4874ef40b809e353b040
GuLoader
+ 5'729 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader
Link:
https://tria.ge/reports/210929-lwm9taeegj/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Guloader,Cloudeye
Unpacked files
SH256 hash:
5e0716efef9b86fed46cec2da9116f481add142b65aeb45be6d16666ac583404
MD5 hash:
7502a82156bca60a8aadd2b3cc1ccfbe
SHA1 hash:
2f0fe3beb1d88074283c2234600edf6f37d43e5e
Link:
https://www.unpac.me/results/60429ff4-51df-4843-a504-1164ea5eb26b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5e0716efef9b86fed46cec2da9116f481add142b65aeb45be6d16666ac583404

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:quakbot_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:silentbuilder_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 5e0716efef9b86fed46cec2da9116f481add142b65aeb45be6d16666ac583404

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1597404/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/193087/

Comments