MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 69c845dfc6e399c55730f8ffe5a7c822f3b36f94cf5905415d8b673e9f391329. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 10
| SHA256 hash: | 69c845dfc6e399c55730f8ffe5a7c822f3b36f94cf5905415d8b673e9f391329 |
|---|---|
| SHA3-384 hash: | 8c90572362afc9675bf9c4eeb1816b3b777655262ebf014a5c4055bc459c87269e0882f3bc8d81734af2493a8e0270a2 |
| SHA1 hash: | 119376d584327a4e5614088d84d384d3f96e9a4f |
| MD5 hash: | db9a0bdd52dfc8224f91d79cbf1779c1 |
| humanhash: | fanta-six-jersey-beer |
| File name: | RRQ - STOC22001139.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 777'896 bytes |
| First seen: | 2023-01-27 17:57:23 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b34f154ec913d2d2c435cbd644e91687 (533 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer) |
| ssdeep | 6144:+VGdx6x0deI2yRqXayPF5PY4U64zaxAYu4phoq/JLx6ovKYD6B8Kn6jh3VrQApHv:KGdsmTeF5PY4Z9hvOL6d3VzpvGuQbKYG |
| Threatray | 4'933 similar samples on MalwareBazaar |
| TLSH | T199F4D0C3FE1098D5E83C4F3215B69D761A7EBC7E7A98049F719473AA1C326030927D6A |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 71e4e4ecaca0f0f1 (4 x GuLoader) |
| Reporter | Anonymous |
| Tags: | exe GuLoader signed |
Code Signing Certificate
| Organisation: | Fremskridtsby |
|---|---|
| Issuer: | Fremskridtsby |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | 2023-01-16T01:47:52Z |
| Valid to: | 2026-01-15T01:47:52Z |
| Serial number: | -6f4999718aaeb011 |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | 9e56dd4f2bfd4a7593fb09a417437b7377bf148749ea7a93fe97ffcb9184cecf |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
1
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RRQ - STOC22001139.rar
Verdict:
Suspicious activity
Analysis date:
2023-01-16 05:14:09 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a custom TCP request
Creating a window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% subdirectories
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
GuLoader
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Signature
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect Any.run
Yara detected GuLoader
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2023-01-16 03:15:13 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
18 of 39 (46.15%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 4'923 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery
Behaviour
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Checks installed software on the system
Loads dropped DLL
Unpacked files
SH256 hash:
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 hash:
75ed96254fbf894e42058062b4b4f0d1
SHA1 hash:
996503f1383b49021eb3427bc28d13b5bbd11977
SH256 hash:
69c845dfc6e399c55730f8ffe5a7c822f3b36f94cf5905415d8b673e9f391329
MD5 hash:
db9a0bdd52dfc8224f91d79cbf1779c1
SHA1 hash:
119376d584327a4e5614088d84d384d3f96e9a4f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.