MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f33f5e3a23420dacdc26fb8e2eef07fe482e634d4b832b0917cbe7ed37864f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f33f5e3a23420dacdc26fb8e2eef07fe482e634d4b832b0917cbe7ed37864f5
SHA3-384 hash: 522886953de54460f44b53029c977affe8bdad8550c3953900c5bcd021ada1b7b2ffe95141a25fda23b417b330b037e6
SHA1 hash: 16a6d2ac44b8ac3cbe112916d8cd9912d3f0dbf7
MD5 hash: 6a9035b7435c6aa9e6c8e31cf771e316
humanhash: chicken-hawaii-harry-blossom
File name:dwg.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2021-02-25 14:18:31 UTC
Last seen:2021-02-26 08:31:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c6ebaa5f331077d9c6c3ae892d7a39ce (3 x GuLoader, 1 x Formbook)
ssdeep 1536:AbLxrs30pwHPhtvxYovnvasYyFbJotMK8nlKmbL:ILPM5QyF1vHL
TLSH 75A329A0F05CE51ADBDECC331657F66B50927CA09905852330B2671F2B722B1DEA16BE
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtp2.hiworks.co.kr
Sending IP: 121.254.168.210
From: "escos" <escos_et@escos-et.com>
Reply-To: "escos" <escos_et@escos-et.com>
Subject: Drawing of order
Attachment: dwg.lzh (contains "dwg.exe")

GuLoader payload URL:
http:8PormCF
http://45.153.203.33/mb.bin

Intelligence

File Origin
# of uploads :
4
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dwg.exe
Verdict:
Malicious activity
Analysis date:
2021-02-25 14:38:46 UTC
Tags:
trojan guloader loader formbook stealer
Link:
https://app.any.run/tasks/5f739595-0c30-4b29-80b7-29f0cdd25cd7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/119252/
Detection(s):
SecuriteInfo.com..27847.3887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Sending an HTTP GET request
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/618820
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Yara detected Generic Dropper
Yara detected GuLoader
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 358411 Sample: dwg.exe Startdate: 25/02/2021 Architecture: WINDOWS Score: 100 29 www.qionglaizhan.com 2->29 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 5 other signatures 2->45 11 dwg.exe 1 2->11         started        signatures3 process4 signatures5 55 Contains functionality to detect hardware virtualization (CPUID execution measurement) 11->55 57 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 11->57 59 Tries to detect Any.run 11->59 61 3 other signatures 11->61 14 dwg.exe 6 11->14         started        process6 dnsIp7 37 45.153.203.33, 49716, 80 NETLABFR Netherlands 14->37 63 Modifies the context of a thread in another process (thread injection) 14->63 65 Tries to detect Any.run 14->65 67 Maps a DLL or memory area into another process 14->67 69 3 other signatures 14->69 18 explorer.exe 6 14->18 injected signatures8 process9 dnsIp10 31 www.guillemaudexcellenceauto.com 146.148.189.216, 49733, 80 HENGTONG-IDC-LLCUS United States 18->31 33 delmarranch.com 34.102.136.180, 49727, 80 GOOGLEUS United States 18->33 35 11 other IPs or domains 18->35 47 System process connects to network (likely due to code injection or exploit) 18->47 22 rundll32.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
guloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6f33f5e3a23420dacdc26fb8e2eef07fe482e634d4b832b0917cbe7ed37864f5/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 14:19:07 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n4z7ly5cgqqnvtocn64of3xqp7sifzru2s4dfmerps7h5u3ymt2q._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader loader rat spyware stealer trojan
Link:
https://tria.ge/reports/210225-d8cr642gpn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Formbook
Xloader
Malware Config
C2 Extraction:
http://www.karatetheokinawaway.com/gzjz/
Unpacked files
SH256 hash:
49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3
MD5 hash:
1f1b425190b2fb0396ad2d538b1060ba
SHA1 hash:
413f98641d46fdcabfcaf64f29495667de6282ea
Link:
https://www.unpac.me/results/a9c9809d-bfc0-4ae0-9d14-9b61f4821fa2/
SH256 hash:
6f33f5e3a23420dacdc26fb8e2eef07fe482e634d4b832b0917cbe7ed37864f5
MD5 hash:
6a9035b7435c6aa9e6c8e31cf771e316
SHA1 hash:
16a6d2ac44b8ac3cbe112916d8cd9912d3f0dbf7
Link:
https://www.unpac.me/results/a9c9809d-bfc0-4ae0-9d14-9b61f4821fa2/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 77150661337a709b7a871651b5ed92578771f8317e6db17afb7fcdc96700d535

GuLoader

Executable exe 6f33f5e3a23420dacdc26fb8e2eef07fe482e634d4b832b0917cbe7ed37864f5

(this sample)

  
Dropped by
MD5 ac0865cb13c1d3b62c8a8dbe339ca5ae
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/119252/
  
Dropped by
SHA256 77150661337a709b7a871651b5ed92578771f8317e6db17afb7fcdc96700d535

Comments