MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 920fe160ef3a22e69e296128b12731811355dec4de30b234ec133c27947f8945. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 920fe160ef3a22e69e296128b12731811355dec4de30b234ec133c27947f8945
SHA3-384 hash: bdde05b1dc3f09a4d706ae824bd9e9bb3916722352ee215d1e7a011dc07d9c72c0c8c7623096ddc88226eb8e1bfd775c
SHA1 hash: 49db9489ffda07cc01041409fb522d5cbe9c2503
MD5 hash: 15203893d3bf56527496bc31d46e20c6
humanhash: august-table-don-seventeen
File name:DETAILS AND INVOICES.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:396'430 bytes
First seen:2023-02-24 21:01:46 UTC
Last seen:2023-02-27 11:11:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 93dfc16ed07ebeb5b405221f10d12c0e (30 x GuLoader, 4 x RemcosRAT, 1 x AgentTesla)
ssdeep 6144:o4E6JRqVYtTfGUj+GkCCb96laHvigFXkijDhZ1D+b5x4rk:o4EVUdpCZ6SPNRZEtxYk
Threatray 12 similar samples on MalwareBazaar
TLSH T1428401D2826444CBED7A0772A43B5D1225A77D6EF8F1E61E97ADB5608F732C3001B90B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 31090d1101010105 (4 x GuLoader)
Reporter TeamDreier
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
210
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DETAILS AND INVOICES.exe
Verdict:
Malicious activity
Analysis date:
2023-02-24 21:06:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/29402713-fc3b-4934-b347-f9afc6966783

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/369533/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.18882.24538.15846.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Searching for the window
Searching for the Windows task manager window
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
guloader overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63f925d4124864afb39e373c/reports/4d68ddf9-f702-4fe1-89c8-798c4c18048d/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/920fe160ef3a22e69e296128b12731811355dec4de30b234ec133c27947f8945
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4e413f5c-5de7-41c7-a0b9-8fdc58dfcf3c
Result
Threat name:
FormBook, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.rans.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1182126
Signature
Antivirus detection for URL or domain
Executable has a suspicious name (potential lure to open the executable)
Found potential ransomware demand text
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Mass process execution to delay analysis
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 11742 Sample: DETAILS AND INVOICES.exe Startdate: 24/02/2023 Architecture: WINDOWS Score: 100 52 www.seolutions.xyz 2->52 54 www.pikgit.site 2->54 56 22 other IPs or domains 2->56 74 Snort IDS alert for network traffic 2->74 76 Malicious sample detected (through community Yara rule) 2->76 78 Antivirus detection for URL or domain 2->78 80 8 other signatures 2->80 11 DETAILS AND INVOICES.exe 27 2->11         started        signatures3 process4 file5 48 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 11->48 dropped 50 C:\Users\user\AppData\Local\...\System.dll, PE32 11->50 dropped 92 Tries to detect Any.run 11->92 15 DETAILS AND INVOICES.exe 11->15         started        19 powershell.exe 11->19         started        21 powershell.exe 11->21         started        23 71 other processes 11->23 signatures6 process7 dnsIp8 64 ecobau.ru 37.228.88.134, 49831, 80 MTW-ASRU Russian Federation 15->64 66 Modifies the context of a thread in another process (thread injection) 15->66 68 Tries to detect Any.run 15->68 70 Maps a DLL or memory area into another process 15->70 72 2 other signatures 15->72 25 explorer.exe 15->25 injected 29 conhost.exe 19->29         started        31 conhost.exe 21->31         started        33 conhost.exe 23->33         started        35 conhost.exe 23->35         started        37 conhost.exe 23->37         started        39 68 other processes 23->39 signatures9 process10 dnsIp11 58 galithasak.com 192.185.48.232, 49835, 49890, 80 UNIFIEDLAYER-AS-1US United States 25->58 60 seolutions.xyz 192.254.186.37, 49873, 49874, 49875 UNIFIEDLAYER-AS-1US United States 25->60 62 11 other IPs or domains 25->62 90 System process connects to network (likely due to code injection or exploit) 25->90 41 chkdsk.exe 25->41         started        signatures12 process13 signatures14 82 Tries to steal Mail credentials (via file / registry access) 41->82 84 Tries to harvest and steal browser information (history, passwords, etc) 41->84 86 Writes to foreign memory regions 41->86 88 3 other signatures 41->88 44 firefox.exe 41->44         started        process15 process16 46 WerFault.exe 44->46         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/920fe160ef3a22e69e296128b12731811355dec4de30b234ec133c27947f8945/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2023-02-24 12:25:16 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
6 of 39 (15.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sih6cyhphironhrjmeulcjzrqejvlxwe3yylenhmcm6cpfd7rfcq._file
Verdict:
malicious
Similar samples:
1390ffaba8428295de1c41cb39358e5de9ab79868b1f79a6697fd9e72e23e6ee
GuLoader
2a6ce3844cb0426fefb02d57bbb8eab576d0f089231c61aa1293cf0028d1db85
GuLoader
51ddc94e9230a48fc787f52b05342f7b1fec562bb7bd8d4155e99156e6564fde
GuLoader
6ec684964e715bd7b62ec19904871853f5be9bf40dcd835c230ced852f24cc34
GuLoader
79e1fc85396ae65e8431f8ceb92fefb5ec396381840d830c415ea2d81cb78a49
GuLoader
7dcbdd10f6e8cdf4c3d982ad15810b978a9b269f8ff525ec1e9187a4d0baf715
GuLoader
b65f37c2f7def47bd57ae2837b9c422113da608c3b37a80f62e0332fb717546f
GuLoader
b98d60109c9ccfaac33c719992c026b59e3bc54bbe9fe24bc0fecaa016a02959
GuLoader
d379ffe32dfb2d6d386b6d9c3cbae49e49241ac25a14d2974c286bfa45aa50b9
GuLoader
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230224-zvfp8sah52/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
ec156cb0f64588f8c34a7d45c57b250779143cf3816081829810a017f0cf966f
MD5 hash:
b3017435b63a99f6a3037cfe0c7c8b1e
SHA1 hash:
41a582b60f099b65f95ac64e1a5cdce0356a6b6f
Link:
https://www.unpac.me/results/35f0c238-a482-422c-b06c-5a4dad5f1d5a/
SH256 hash:
9352c8971d0046a5526da1889f841eab8ef695e4786b6656f06af289cf32de44
MD5 hash:
402792a47412801287bc610a15cd6076
SHA1 hash:
f2990ac9e903bec596266bf1a1c340ec90ed4ee6
Link:
https://www.unpac.me/results/35f0c238-a482-422c-b06c-5a4dad5f1d5a/
SH256 hash:
9a6a9370f1d152a169ac8b1e0e5baf5c6a0a7fe5fde863ec19008d15cea14e18
MD5 hash:
1f6ad8f7ee95ef0d2196e2a1a9f4819c
SHA1 hash:
3cd158298cb917dd5ad686d1ec93781911f460b0
Link:
https://www.unpac.me/results/35f0c238-a482-422c-b06c-5a4dad5f1d5a/
SH256 hash:
920fe160ef3a22e69e296128b12731811355dec4de30b234ec133c27947f8945
MD5 hash:
15203893d3bf56527496bc31d46e20c6
SHA1 hash:
49db9489ffda07cc01041409fb522d5cbe9c2503
Link:
https://www.unpac.me/results/35f0c238-a482-422c-b06c-5a4dad5f1d5a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/920fe160ef3a22e69e296128b12731811355dec4de30b234ec133c27947f8945

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 920fe160ef3a22e69e296128b12731811355dec4de30b234ec133c27947f8945

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/369533/

Comments