MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9381fe0c3cf875295a8f591384aa265f7055886439c2f6879dd31585b7c7e8fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9381fe0c3cf875295a8f591384aa265f7055886439c2f6879dd31585b7c7e8fc
SHA3-384 hash: 1077849f83666fc6f871d9f25e8dd1c63fd055251d1986504f6cbe9aed1789d09425cdf6ad6537cee2b0afe5596a514a
SHA1 hash: a0c2794e0f0a43461da1d73852d0ba78ec9cbb46
MD5 hash: 0c20e160f37e9433adfc2dc5351a2571
humanhash: leopard-six-fifteen-robert
File name:CI-BL202006-10.jpg.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 04:40:39 UTC
Last seen:2020-06-10 13:59:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 800e7ff548e65a0d8422bc2347aae841 (1 x GuLoader)
ssdeep 768:bGrEGMjJvbviBoGLU9OCZFZ0bf4EunrWG0DO1zKBao2TOOmNT6/k1E:bVG0bGL0OC6bv8kOZAaouJ
Threatray 827 similar samples on MalwareBazaar
TLSH C6535B5B2D08E993E07087B129A285A067297C285105BF077E5CBF6CEB716C27ED731B
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
4
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7442/
Detection(s):
SecuriteInfo.com.Win32.Injector.EMIL.28971.UNOFFICIAL
Create hunting rule

Result
Threat name:
FormBook GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/370432
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 237210 Sample: CI-BL202006-10.jpg.exe Startdate: 10/06/2020 Architecture: WINDOWS Score: 100 37 www.cheapestshopping.site 2->37 39 www.dndedu.com 2->39 51 Malicious sample detected (through community Yara rule) 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 Sigma detected: Steal Google chrome login data 2->55 57 5 other signatures 2->57 11 CI-BL202006-10.jpg.exe 1 2->11         started        signatures3 process4 signatures5 71 Contains functionality to detect hardware virtualization (CPUID execution measurement) 11->71 73 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 11->73 75 Tries to detect virtualization through RDTSC time measurements 11->75 77 2 other signatures 11->77 14 CI-BL202006-10.jpg.exe 6 11->14         started        process6 dnsIp7 47 tfyupg.db.files.1drv.com 14->47 49 onedrive.live.com 14->49 79 Modifies the context of a thread in another process (thread injection) 14->79 81 Maps a DLL or memory area into another process 14->81 83 Sample uses process hollowing technique 14->83 85 2 other signatures 14->85 18 explorer.exe 1 14->18 injected signatures8 process9 dnsIp10 41 www.magentos.info 199.192.30.223, 49738, 49739, 80 unknown United States 18->41 43 www.yr-ct.com 43.239.166.28, 49737, 80 unknown Hong Kong 18->43 45 www.409uto.info 18->45 59 System process connects to network (likely due to code injection or exploit) 18->59 22 svchost.exe 1 12 18->22         started        signatures11 process12 signatures13 61 Tries to steal Mail credentials (via file access) 22->61 63 Tries to harvest and steal browser information (history, passwords, etc) 22->63 65 Modifies the context of a thread in another process (thread injection) 22->65 67 2 other signatures 22->67 25 cmd.exe 2 22->25         started        29 cmd.exe 1 22->29         started        process14 file15 35 C:\Users\user\AppData\Local\Temp\DB1, SQLite 25->35 dropped 69 Tries to harvest and steal browser information (history, passwords, etc) 25->69 31 conhost.exe 25->31         started        33 conhost.exe 29->33         started        signatures16 process17
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 23:58:58 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=soa74db47b2sswuplejyjkrgl5yflcdehhbpnb452mkyln6h5d6a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
32922de2503537acaf01c6ea91ecbbf5af81282f1847110792464144f34451c2
GuLoader
474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f
GuLoader
4fa18cee955bc3a264f0b07c5b23f1d4584bc8bf3506ee2a3a55db73dd79f4cc
GuLoader
6d043b33b33e6baaf7514b9ca56f8dbd8aa57bc71a9040bf438bc780c1a4ad5f
GuLoader
8357fd2e6327d05c86d6e2729b65eafaf756322bc1e7bb7878cf75595c40abe2
GuLoader
a488990c82230074fdf4f22a014a8f05dbb2bdc055c096c4d4a28b3a8055a648
GuLoader
aa7170f4c174314d883e1d0a98a14b8256ab63b7ad80dffd45d0ace33ace4580
GuLoader
ad57fdea21b1f9e56e500568a6dba42e239fbed6bbc3e825ccf0342e6f1a9064
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
cbf57cc719888dac0ce1630ed61752c1689e624174b8bf6c6e1130c2b897fb7e
GuLoader
+ 817 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-4h379hzpsa/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

ace 4ebf31ee723bf829896b97ed1d46450618ab9983e60d515d92b0fe6c04a340ba

GuLoader

Executable exe 9381fe0c3cf875295a8f591384aa265f7055886439c2f6879dd31585b7c7e8fc

(this sample)

  
Dropped by
MD5 b3c37d3b4e986be26e127d1d3b0cef13
  
Dropped by
SHA256 4ebf31ee723bf829896b97ed1d46450618ab9983e60d515d92b0fe6c04a340ba
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/7442/

Comments