MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 869a7b8cef4c99f4566d516d861353dab227a727fbaa3f223cb2200c996ba73f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 869a7b8cef4c99f4566d516d861353dab227a727fbaa3f223cb2200c996ba73f
SHA3-384 hash: 3a0b38fa79bf85831be4c8f5ad1e1e74c64f38019b2feac39e2bb5ed7db38f41fab9be4b44fabb9f91e2b5838c93642e
SHA1 hash: bfd9da147997f5c669cc44ce88227d544fbac0d0
MD5 hash: 24dbeb45f944f69c25e9adf93cf4b5d9
humanhash: charlie-bulldog-happy-six
File name:Order List & IMGS.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:291'401 bytes
First seen:2022-06-15 10:18:20 UTC
Last seen:2022-06-17 05:51:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 6144:RbE/HUq4Rbmx0KG1IKbGk+Q5S7aqgtw3iLHWqOTXU8AJgd:RbuLx0l3/ZKTaw3ibWbTEfQ
Threatray 14'894 similar samples on MalwareBazaar
TLSH T1EC54BE86B78AD19BD4E21A361877C3A55631AC005E51DA0F2B8E3F1E2D33FD16F1A784
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 288ae2ec74f13050 (6 x Loki, 3 x NanoCore, 2 x GuLoader)
Reporter GovCERT_CH
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
254
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/280099/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.33998.15641.14995.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a file in the %AppData% directory
Creating a file in the %temp% subdirectories
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/21369/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
guloader nanocore nemesis overlay packed shell32.dll wacatac
Link:
https://www.filescan.io/uploads/62a9b23624ded2bdf727bad7/reports/8f542d0a-9af5-4b63-85e7-cadaba753ae3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/341bd2f8-5006-44d1-b802-206a8387da91
Result
Threat name:
Nanocore, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1013563
Signature
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 646059 Sample: Order List & IMGS.exe Startdate: 15/06/2022 Architecture: WINDOWS Score: 100 36 mtty.linkpc.net 2->36 38 googlehosted.l.googleusercontent.com 2->38 40 2 other IPs or domains 2->40 56 Snort IDS alert for network traffic 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 8 other signatures 2->62 9 Order List & IMGS.exe 2 22 2->9         started        13 CasPol.exe 4 2->13         started        signatures3 process4 file5 34 C:\Users\user\AppData\Local\...\System.dll, PE32 9->34 dropped 64 Writes to foreign memory regions 9->64 66 Tries to detect Any.run 9->66 68 Hides threads from debuggers 9->68 15 CasPol.exe 20 9->15         started        20 CasPol.exe 9->20         started        22 conhost.exe 13->22         started        signatures6 process7 dnsIp8 42 drive.google.com 142.250.181.238, 443, 49746 GOOGLEUS United States 15->42 44 googlehosted.l.googleusercontent.com 216.58.212.129, 443, 49747 GOOGLEUS United States 15->44 46 mtty.linkpc.net 91.192.100.17, 1947, 49748, 49749 AS-SOFTPLUSCH Switzerland 15->46 30 C:\Users\user\AppData\Roaming\...\run.dat, ISO-8859 15->30 dropped 32 C:\Users\user\AppData\Local\...\tmp6438.tmp, XML 15->32 dropped 48 Tries to detect Any.run 15->48 50 Hides threads from debuggers 15->50 52 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->52 24 schtasks.exe 1 15->24         started        26 conhost.exe 15->26         started        54 Uses schtasks.exe or at.exe to add and modify task schedules 20->54 file9 signatures10 process11 process12 28 conhost.exe 24->28         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/869a7b8cef4c99f4566d516d861353dab227a727fbaa3f223cb2200c996ba73f/
Threat name:
Win32.Downloader.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2022-06-15 09:04:31 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
21 of 26 (80.77%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q2nhxdhpjsm7ivtnkfwyme2t3kzcpjzh7ovd6ir4wiqazgllu47q._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
1d6b01cd9add8b2ec0ece3e63c15359a8cc365905da07c2e86cf1ff71239c643
GuLoader
4da8e246e3a6d56fa30521aa94abe40716743b1e045c20c12b36af621b6ee936
GuLoader
517551a240e3ed287c27781d1f0f1dd594d409dc70c5e57b935c6f8105bdb3c8
GuLoader
65197e06d709ab4d34cf5b01ee912043bfbf31d919740c59b72ca5ff7740630c
GuLoader
81048cdddc6f37dafe9b76d5075e6fdf404e508f9cf6a8641c6ddde189b9d062
GuLoader
8923f64c122b957714fb49cc508576f4cd713a49e2b931fee2f4c3058ca8494a
GuLoader
a49a9749919eeb16f0ae6fcdf61c48957a26e34a6d49b05701cb8d41a00f7b10
GuLoader
c46330a24381319de37d38bb3e49708e5ab7cf920bec3ff45fc953e52d77d06a
GuLoader
c5f49cb2146dd5987ac443b0e229cb7b0cfb0d10521651fd986d75d2d752e3cd
GuLoader
+ 14'884 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:nanocore downloader keylogger spyware stealer suricata trojan
Link:
https://tria.ge/reports/220615-mchewsgce9/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Loads dropped DLL
Guloader,Cloudeye
NanoCore
suricata: ET MALWARE Possible NanoCore C2 60B
Malware Config
C2 Extraction:
mtty.linkpc.net:1947
Unpacked files
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/8ae07830-fbf8-420a-8424-2ac93b13497a/
SH256 hash:
869a7b8cef4c99f4566d516d861353dab227a727fbaa3f223cb2200c996ba73f
MD5 hash:
24dbeb45f944f69c25e9adf93cf4b5d9
SHA1 hash:
bfd9da147997f5c669cc44ce88227d544fbac0d0
Link:
https://www.unpac.me/results/8ae07830-fbf8-420a-8424-2ac93b13497a/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/869a7b8cef4c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/869a7b8cef4c99f4566d516d861353dab227a727fbaa3f223cb2200c996ba73f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip fe9d52a276dace67f2c35f5a7ab27c1ed8b06f5a0744bdf1eac48f85aad7f604

GuLoader

Executable exe 869a7b8cef4c99f4566d516d861353dab227a727fbaa3f223cb2200c996ba73f

(this sample)

  
Dropped by
guloader
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/280099/
  
URLhaus
https://urlhaus.abuse.ch/url/2239437/
  
Dropped by
SHA256 fe9d52a276dace67f2c35f5a7ab27c1ed8b06f5a0744bdf1eac48f85aad7f604
  
Dropped by
MD5 7cc0b2e29c670a6aa698a5c11c5ae8d8

Comments