MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fed2050ee10cb43cc63852558597d64e8fe67c30af8682b9f60ce356e24901d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	5fed2050ee10cb43cc63852558597d64e8fe67c30af8682b9f60ce356e24901d
SHA3-384 hash:	29afbdcea8325e59c13dd75d5601d53cbe32ea423eac55e545fb411906fae8f91a450440957a8d7d1102bd35170ec859
SHA1 hash:	1dd3126da75f0cf98e14fb31d433c6d5acbb2d93
MD5 hash:	0c1e5ad5ab266a44be8d175aff239b83
humanhash:	purple-blossom-alaska-seventeen
File name:	ORDER-RFQ-785577.xlsm
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	274'503 bytes
First seen:	2020-08-05 16:20:18 UTC
Last seen:	Never
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	6144:rBHhXcWPxFHWIILW0vYLyu0qwJX6DpPa8oGKkmY4i01VI6f6ET+i:rBH5cux9WlLdr27fmYC1MET+i
TLSH	A74423F449CA674BF62FB8758D6E81D3CB3E70903FA5A61043FA2D5C16D12E9A00768D
Reporter	abuse_ch
Tags:	GuLoader xlsm

abuse_ch

Malspam distributing unidentified malware:

HELO: mta1.witecompanyglobal.ga
Sending IP: 142.11.194.198
From: Eric <geral@merchandisemania.com.pt>
Subject: RE:ORDER-RFQ-785577
Attachment: ORDER-RFQ-785577.xlsm

Unknown payload URL:
http://smarting.rs/wp-content/ORDER-RFQ-785577.exe

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Heur.Macro.Generic.h.e80ad2c0.22412.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Creating a file

Launching a process

Creating a process with a hidden window

Creating a file in the %AppData% directory

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Launching a service

Reading critical registry keys

Creating a file in the %temp% directory

Deleting a recently created file

Sending an HTTP GET request

Stealing user critical data

Creating a process from a recently created file

Unauthorized injection to a system process

Enabling a "Do not show hidden files" option

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/411668

Signature

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Machine Learning detection for dropped file

Office process drops PE file

Sigma detected: Executables Started in Suspicious Folder

Sigma detected: Execution in Non-Executable Folder

Sigma detected: MS Office Product Spawning Exe in User Dir

Sigma detected: Suspicious Program Location Process Starts

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect virtualization through RDTSC time measurements

Yara detected GuLoader

Yara detected VB6 Downloader Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5fed2050ee10cb43cc63852558597d64e8fe67c30af8682b9f60ce356e24901d/

Threat name:

Script.Trojan.Heuristic

Status:

Malicious

First seen:

2020-08-05 16:22:06 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l7wsauhocdfuhtddqusvqwl5mtup4z6dbl4gqk47mdhdk3resaoq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/200805-9yh7d1fgpj/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Office loads VBA resources, possible macro or embedded object present

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Dropper

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/5fed2050ee10cb43cc63852558597d64e8fe67c30af8682b9f60ce356e24901d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.