MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a6153c0ed8295d63f23fae313939e61eb3f94cd61f7a34a22a6557318f032f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 3

Intelligence 3 IOCs YARA 5 File information Comments

SHA256 hash:	6a6153c0ed8295d63f23fae313939e61eb3f94cd61f7a34a22a6557318f032f1
SHA3-384 hash:	397da727aa53c3efca822bd05dc77c689dde8a4a2cffb7f2b173223bb32141555ed6473b0c82c6a215006845c0f00da3
SHA1 hash:	e889cc68f936686679c109ceed24ab0dcd6814e4
MD5 hash:	0c75dcf132cee8e7c60294143b83ad3f
humanhash:	purple-lion-west-michigan
File name:	0c75dcf132cee8e7c60294143b83ad3f.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	192'512 bytes
First seen:	2020-05-28 06:35:52 UTC
Last seen:	2020-05-28 08:22:29 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	0bc47668843deb03784037378aa6fdf9 (3 x GuLoader)
ssdeep	1536:pJlB7Bg9M8Zgoy0n6jSPaJNzB6Ia6qRUcR/TtdOXO6aNf6tSQ0z3DrV8BKR:FxBgF6oxnlSvzBVIVRCXA6s9
Threatray	546 similar samples on MalwareBazaar
TLSH	CB144B22B766EC62EA8159B1D8D1C8F40460BC10C9168A3775C07F7EB5BA2C3B96D733
Reporter	abuse_ch
Tags:	exe GuLoader NetWire nVpn RAT

abuse_ch

NetWire RAT payload URL:
http://naturepack.cc/files/Host_qCFnmiNcq211.bin

NetWire RAT C2:
plunder.nsupdate.info:7070 (185.244.29.175)

Pointing to nVpn:

% Information related to '185.244.29.0 - 185.244.29.255'

% Abuse contact for '185.244.29.0 - 185.244.29.255' is 'abuse@gerber-edv.net'

inetnum: 185.244.29.0 - 185.244.29.255
netname: GERBER-NETWORK
descr: Wonsan, Kangwon-do
descr: Choson Minjujuui Inmin Konghwaguk
country: KP
admin-c: GN5022-RIPE
tech-c: GN5022-RIPE
org: ORG-GN148-RIPE
status: SUB-ALLOCATED PA
mnt-by: GERBER-MNT
created: 2018-01-31T19:41:57Z
last-modified: 2020-04-06T22:16:40Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/5788/

Detection(s):

SecuriteInfo.com.Win32.Injector.EMDX.7466.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Fareit

Status:

Malicious

First seen:

2020-05-28 06:42:03 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 48 (47.92%)

Threat level:

5/5

Verdict:

malicious

Label(s):

netwirerc

guloader

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-jpzdw8e76a/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Malicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	MAL_unspecified_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research

Rule name:	netwire Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research

Rule name:	Suspicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator