🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 924323142124600a3ce73639ec8b07c60e7f751de5eb45ea5d954f925e2e1db0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 924323142124600a3ce73639ec8b07c60e7f751de5eb45ea5d954f925e2e1db0
SHA3-384 hash: b3ee21a0865e2f1c27683112efe551c7ace395dad6344ede273eb870f5897689e14207a3adcbc9130ad604a68ddf5949
SHA1 hash: 808d8ec0b9776c8407aad304576216c0a41bd9b9
MD5 hash: f6b7f10108c5960d09faf903cc72f54e
humanhash: michigan-king-red-six
File name:PR #1112300730.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:348'904 bytes
First seen:2023-06-01 11:53:37 UTC
Last seen:2023-06-01 14:50:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ea4df5d94204fc550be1874e1b77ea7 (254 x GuLoader, 32 x RemcosRAT, 26 x VIPKeylogger)
ssdeep 6144:zwq3Npp+bp0MQNAUVqDXWEf4LuUrfXoIpAhNV2iaAPcJOtxMjDR:zzlAsNAUqZ0ovhqemOrq
Threatray 938 similar samples on MalwareBazaar
TLSH T19F74E0492252E45BC8637575F4ADDAF73672FD4FCF3107432361BEA9F632A828919208
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 018024366e99b102 (1 x GuLoader)
Reporter malwarelabnet
Tags:exe GuLoader remcos signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2023-04-06T02:29:13Z
Valid to:2026-04-05T02:29:13Z
Serial number: 37907d9475612e53a404959a0a56e06bdcbe3d6f
Thumbprint Algorithm:SHA256
Thumbprint: 0cdb1df5ee9bedc8d2cba9bb48320eee8b250baae2ee1b7611b5180368d66101
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
336
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PR #1112300730.exe
Verdict:
No threats detected
Analysis date:
2023-06-01 11:56:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/59488003-1bf7-494a-af08-c9750ccf88b5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/394371/
Detection(s):
SecuriteInfo.com.Win32.SuspectCrc.4127.28827.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/88917/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/647886da8c539ae218a0aeff/reports/60d60501-287c-4408-b7e8-b895678d9b09/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/924323142124600a3ce73639ec8b07c60e7f751de5eb45ea5d954f925e2e1db0
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/88c773f6-4f1d-4a42-ad4d-9dbb1460d764
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1246774
Signature
Multi AV Scanner detection for submitted file
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/924323142124600a3ce73639ec8b07c60e7f751de5eb45ea5d954f925e2e1db0/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-06-01 02:24:47 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
15 of 37 (40.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sjbsgfbberqauphhgy46zcyhyyhh65i54xvul2s5svhzexrodwya._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
07fa172e1404c76738226cefc6e5d45559430c9946e419ed089d9ae5690783f9
GuLoader
18b1abba90cf4a74b7216b91f02febb1c8694113f5ddc3507fd35b66253bcb83
GuLoader
2afb072fe81c319cbe4cee6d2c660a16a833b4243c8e5ea0aa041b2b974c3ef5
GuLoader
30c31a99eda4daca4085458968e8d09f450f1ed7170f76b95cf7694acb0c7f02
GuLoader
3f6b1b62fd63112b0626567e8cd6a9179499109f1aee6fe0627d9b429add64d1
GuLoader
49f8ea644b5a69f7e8569c513168fa892922cc8e3e56617d7d225c9a85e3d520
GuLoader
b3aef47ce44656fbea5139d6bd03d8847f633199b00462aefebe43ac6c91e352
GuLoader
d989ab685c59463a2ae115503881d520032409525de9846d458583e4ad75fc15
GuLoader
dfd5aecc6088baf366549e3a7a163c0a7dec356ff6efaab012408cdb42eb2a94
GuLoader
+ 928 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader
Link:
https://tria.ge/reports/230601-n2vxysee5w/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Loads dropped DLL
Guloader,Cloudeye
Unpacked files
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/ac9af20c-c9a9-4e37-927f-69a21e421297/
SH256 hash:
924323142124600a3ce73639ec8b07c60e7f751de5eb45ea5d954f925e2e1db0
MD5 hash:
f6b7f10108c5960d09faf903cc72f54e
SHA1 hash:
808d8ec0b9776c8407aad304576216c0a41bd9b9
Link:
https://www.unpac.me/results/ac9af20c-c9a9-4e37-927f-69a21e421297/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/924323142124/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/924323142124600a3ce73639ec8b07c60e7f751de5eb45ea5d954f925e2e1db0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/394371/

Comments