MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c
SHA3-384 hash: ee67ccdec9bdeb6fbc6ead415da2026c9d404c7747681be0f465a3b373d135471a81d1688d4ecd7dd330be706fe9e06f
SHA1 hash: 6bf34b851bf47514affbb54ea56da74bde446b1e
MD5 hash: 2bd2b08ca47144328cbc68041d8714be
humanhash: winner-spaghetti-mike-princess
File name:2bd2b08ca47144328cbc68041d8714be
Download: download sample
Signature GuLoader
Create hunting rule
File size:2'094'012 bytes
First seen:2024-01-01 04:00:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 671f2a1f8aee14d336bab98fea93d734 (182 x GuLoader, 4 x Formbook, 4 x RemcosRAT)
ssdeep 49152:WaUQl+AMminT6xkk26lWehIlbJZ7a07xznKMj5RyXE1ID1PX:DLIAMmuu9Ym+xznKMj58aIxPX
TLSH T1C3A5337482E6E802D0661378DA25CB24EC97CC1C625ABFEA8350FA72557B9C5331E74F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter zbetcheckin
Tags:32 exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0eb49cae715e2f31551ea4afa64045540ed77ab891ba1864660b74af64a16971.exe
Verdict:
Suspicious activity
Analysis date:
2024-01-01 04:07:40 UTC
Tags:
opendir
Link:
https://app.any.run/tasks/71917c9c-3c94-47c3-9bc7-8c4665bf0872

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Msilheracles-10017861-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Modifying a system file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65923901f4b6e5e16362d44f/reports/848b8aeb-69c5-4c2d-a023-454b97a17b64/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c03b76f2-1175-485a-91c8-7221cc785830
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1368468
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c/
Threat name:
Win32.Ransomware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-12-30 14:36:13 UTC
File Type:
PE (Exe)
Extracted files:
205
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=spxuerhng4ouxzizkvduyfyto2pxs4zaaaynrv5fyymhoi3lzm6a._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/240101-ek8caabbgm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Enumerates physical storage devices
Adds Run key to start application
Checks installed software on the system
Loads dropped DLL
Unpacked files
SH256 hash:
93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c
MD5 hash:
2bd2b08ca47144328cbc68041d8714be
SHA1 hash:
6bf34b851bf47514affbb54ea56da74bde446b1e
Link:
https://www.unpac.me/results/6ba132a9-ca15-4149-9c6e-f643191d736f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2745586/

Comments


Avatar
zbet commented on 2024-01-01 04:00:27 UTC

url : hxxp://su.eda1.ru/dist/kkm/kkm.exe