MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65e331380851f9aced88e0aa9e78e70d04131fa073c5278f6e7fbeb0dff82267. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65e331380851f9aced88e0aa9e78e70d04131fa073c5278f6e7fbeb0dff82267
SHA3-384 hash: 307a67f517fb3e3f2dd160969a48957a986e774944b0f10216269ded82815737dd4d548074b698b80e20d7be98f76c59
SHA1 hash: 5c702b21b03bdae15874d2f01fb689dbf652ce05
MD5 hash: a036c6f8d7e2030b3e34089492982613
humanhash: march-cat-queen-louisiana
File name:NEW PO #4076524335_2022-10-10.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:464'352 bytes
First seen:2022-10-10 14:27:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e221f4f7d36469d53810a4b5f9fc8966 (118 x GuLoader, 28 x RemcosRAT, 21 x Formbook)
ssdeep 12288:7tqsuHdhA0S3GynVlKFuR1rqv4rG5sdq7ufFa9/Z:IdOEEkkLqY/da9B
TLSH T145A4E0213258C5BEC85CC671D6B95AFA9D767E88CA2016873B363CAC7539243F908377
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter malwarelabnet
Tags:AgentTesla exe GuLoader signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-01-19T05:25:00Z
Valid to:2025-01-18T05:25:00Z
Serial number: -4acdd4f75669d31f
Thumbprint Algorithm:SHA256
Thumbprint: 8ab454a1066d564dcd01473651fdfff94713c9722af85cd641be89c5a9d5dc5b
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318493/
Detection(s):
SecuriteInfo.com.Win32.Trojan.Cobalt.Phhf.24425.24059.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63442bf7b321c2e8ff63d502/reports/472ae3df-cc8b-461d-942b-4a6314f1579b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2a51e1f7-57da-4fdf-afae-7e54c51422ac
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1087135
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65e331380851f9aced88e0aa9e78e70d04131fa073c5278f6e7fbeb0dff82267/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-10 10:48:48 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mxrtcoaikh42z3mi4cvj46hhbucbgh5aopcspd3op67lbx7yejtq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:guloader collection discovery downloader keylogger spyware stealer trojan
Link:
https://tria.ge/reports/221010-rszrbscbd9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks installed software on the system
Accesses Microsoft Outlook profiles
Checks QEMU agent file
Loads dropped DLL
AgentTesla payload
AgentTesla
Guloader,Cloudeye
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e1f26e1a-1ce8-4a8d-a95a-e83c160cc4cb
Unpacked files
SH256 hash:
ab4aa2dfafe6e48eb92df806c74b554188d11611b2551bc777e1eeb197b8430d
MD5 hash:
3e7922543bd91e60c2293959b1a8ef14
SHA1 hash:
ba8e2fc639328edb6f56a4a2b45f6d006a8ca233
Link:
https://www.unpac.me/results/012e8bcd-8c60-4e97-b22d-6602550590c2/
SH256 hash:
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 hash:
7399323923e3946fe9140132ac388132
SHA1 hash:
728257d06c452449b1241769b459f091aabcffc5
Link:
https://www.unpac.me/results/012e8bcd-8c60-4e97-b22d-6602550590c2/
SH256 hash:
65e331380851f9aced88e0aa9e78e70d04131fa073c5278f6e7fbeb0dff82267
MD5 hash:
a036c6f8d7e2030b3e34089492982613
SHA1 hash:
5c702b21b03bdae15874d2f01fb689dbf652ce05
Link:
https://www.unpac.me/results/012e8bcd-8c60-4e97-b22d-6602550590c2/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/65e331380851/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
GuLoader
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/65e331380851f9aced88e0aa9e78e70d04131fa073c5278f6e7fbeb0dff82267

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/318493/

Comments