🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023
SHA3-384 hash: 7d3b88cf451603fb7095256f37f4a76e40d7da1cd80a36b1c076a50bf4515a0e98bb3b3e26c4c2efe3e6f416f42ad242
SHA1 hash: a17817b44856cc038f5808738ce9ebebbe696f44
MD5 hash: 0d66a9a25e877722a0040f235d5d5487
humanhash: colorado-march-leopard-quiet
File name:940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023
Download: download sample
Signature GuLoader
Create hunting rule
File size:663'488 bytes
First seen:2024-04-04 11:21:40 UTC
Last seen:2024-04-04 12:25:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 17b7d61bda0f7478e36d9ce3d4170680 (23 x GuLoader, 7 x AgentTesla, 6 x njrat)
ssdeep 12288:RXJSk+Ky4sRf7wRqBdjWdjzLBjlegmKTsEs+F8LTCFfTZJt8HE+7cC+2t:TSke4sRzwY3jWhLzJmKIEshnyfztD0cS
TLSH T149E423215DE5806BDBE72DF319B1A538EFB5FA192C65120F0B1867542EB0B83844F36E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter adrian__luca
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Stumphalen
Issuer:Stumphalen
Algorithm:sha256WithRSAEncryption
Valid from:2023-07-31T02:44:08Z
Valid to:2026-07-30T02:44:08Z
Serial number: 07e07bb308ccb73cc6de1445931f8bc1888fe623
Thumbprint Algorithm:SHA256
Thumbprint: a359573d66c62532981ffb5dad69e102915aabbc86a059d0919ba210658e3710
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
325
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023
Verdict:
Malicious activity
Analysis date:
2024-04-04 11:20:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/16eb1f18-c41c-4a95-8133-36783fb035db

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Launching a process
Changing a file
Running batch commands
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/660e8d66eda31927461c5e6f/reports/ac24a169-dcca-441f-80b7-8dc2629e9210/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/91df83c9-2a3a-4129-bc99-5e2294db383e
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1420104
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Powershell drops PE file
Sample uses process hollowing technique
Suspicious powershell command line found
Writes to foreign memory regions
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-03-18 10:57:21 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
14 of 24 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sqfdirmoe5hce7i6hkyggd2jj5x34zlcivq5ixvy26pe7q7zcarq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/240404-ngjzysea96/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Unpacked files
SH256 hash:
940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023
MD5 hash:
0d66a9a25e877722a0040f235d5d5487
SHA1 hash:
a17817b44856cc038f5808738ce9ebebbe696f44
Link:
https://www.unpac.me/results/2d3f3f1e-1881-46b5-b055-c2f8a98cec3e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/940a34458e27/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/940a34458e274e227d1e3ab0630f494f6fbe65624561d45eb8d79e4fc3f91023

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetWindowsDirectoryW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments