MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 724822c0f33c87c4b05fc64ff9c817348b4decd6dc2b3836fd51d0a97cf14949. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 724822c0f33c87c4b05fc64ff9c817348b4decd6dc2b3836fd51d0a97cf14949
SHA3-384 hash: 7de7c22af504b4efd280029c97566b5cb4cf8f6b2bc3d0e6bd73babd0f64e35aef2715255cc18ed9e950b37d1fc7ed83
SHA1 hash: 0a54af10bd0f7a7ca30595063157c006f54753bd
MD5 hash: 1ae1ce5277b8be661231619d6dc80a0d
humanhash: glucose-lactose-angel-hamper
File name:bluezx.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:153'317 bytes
First seen:2022-06-06 05:46:25 UTC
Last seen:2022-06-06 06:39:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 3072:ufY/TU9fE9PEtuGbvq/pu0Q63AmD9/mCg3XRYNTOYrhf7KSpnKeU:YYa6uelnD01YQYrhrpnpU
Threatray 14'314 similar samples on MalwareBazaar
TLSH T13FE3F14072F1C0A3F6725AB02E755B277FB9AA053990D70F27649A6C79323929D0E31B
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter JoulK
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bluezx.exe
Verdict:
Malicious activity
Analysis date:
2022-06-06 05:47:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/06e132df-54b2-4573-9ba9-5d22a6a926a2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/276875/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.44260.3069.6566.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Searching for the window
Creating a file
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
nemesis wacatac
Link:
https://www.filescan.io/uploads/629d94e15dc88d357163846a/reports/0d3c5b89-63db-4f87-87ac-e16b10473ada/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac1429ab-17b2-41ab-bb54-4b05978d484e
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1007090
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 639582 Sample: bluezx.exe Startdate: 06/06/2022 Architecture: WINDOWS Score: 88 21 prda.aadg.msidentity.com 2->21 23 onedrive.live.com 2->23 25 Found malware configuration 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected GuLoader 2->29 31 3 other signatures 2->31 8 bluezx.exe 13 37 2->8         started        signatures3 process4 file5 19 C:\Users\user\AppData\Local\...\System.dll, PE32 8->19 dropped 33 Writes to foreign memory regions 8->33 35 Tries to detect Any.run 8->35 37 Hides threads from debuggers 8->37 12 CasPol.exe 13 8->12         started        15 CasPol.exe 8->15         started        signatures6 process7 signatures8 39 Tries to detect Any.run 12->39 41 Hides threads from debuggers 12->41 17 conhost.exe 12->17         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/724822c0f33c87c4b05fc64ff9c817348b4decd6dc2b3836fd51d0a97cf14949/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2022-06-03 09:28:57 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ojecfqhthsd4jmc7yzh7tsaxgsfu33gw3qvtqnx5khiks7hrjfeq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
05d4b6fb977b10ac13de1711ff83419415b730c99fc463d7159111418b64b702
GuLoader
06139d63dd6245a7ddc44c5d812a80da0b23b984c42fde376465238cb4430064
GuLoader
06bdd4b6e0c9bfc483091774c2bff1763b330baa8257f59dddcd56aeafb92d58
GuLoader
23b5df2d469238921bc4292d4ad2f179d57b19eba17a93c37af5d3ccae03f1c0
GuLoader
2bdd4101f8e038054ae6a169fde832f151b5f9902aac72e62e83416b023963ea
GuLoader
76ff37e66c52f5b613920fff3dfd22e300fe8bdd228baf76b843f198195680f7
GuLoader
da3208711d472f6c9af1141faa1272cab7b80cbaef1cfe0c24c5b1597f7a0c99
GuLoader
e6373eddd3eea61d770a921ee1f63f43145fafef60b2303bb8d2633a895f6b86
GuLoader
+ 14'304 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader discovery downloader
Link:
https://tria.ge/reports/220606-ggvywsaegm/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks installed software on the system
Checks QEMU agent file
Loads dropped DLL
Guloader,Cloudeye
Unpacked files
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/20507d91-6728-4fb9-b650-7792071f2780/
SH256 hash:
724822c0f33c87c4b05fc64ff9c817348b4decd6dc2b3836fd51d0a97cf14949
MD5 hash:
1ae1ce5277b8be661231619d6dc80a0d
SHA1 hash:
0a54af10bd0f7a7ca30595063157c006f54753bd
Link:
https://www.unpac.me/results/20507d91-6728-4fb9-b650-7792071f2780/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/724822c0f33c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/724822c0f33c87c4b05fc64ff9c817348b4decd6dc2b3836fd51d0a97cf14949

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 724822c0f33c87c4b05fc64ff9c817348b4decd6dc2b3836fd51d0a97cf14949

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2143640/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/276875/

Comments