MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9703ca54765334af19f56357bbbda992a8d6fadc48052d15a46d68024ef2b2ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	9703ca54765334af19f56357bbbda992a8d6fadc48052d15a46d68024ef2b2ec
SHA3-384 hash:	e27a59d889509d72af83943f8e691831eb3b3ce2b47799973a28f281f4093fc88f2f9ff50e26d5b5fd55623cecac9347
SHA1 hash:	4457c7db89366d2498d2a075360fa1c803ed4706
MD5 hash:	f631fece402bf1af1bf1eeccd2462f1f
humanhash:	purple-uncle-crazy-failed
File name:	f631fece402bf1af1bf1eeccd2462f1f
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	148'912 bytes
First seen:	2022-07-15 03:17:30 UTC
Last seen:	2024-07-24 19:20:45 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	5f0c714c36e6cc016b3a1f4bc86559e4 (199 x GuLoader, 14 x Formbook, 4 x AgentTesla)
ssdeep	3072:BkBGWOsTIJgIDU5A/cwPbNF50ioENc5erpEi768CBipV/bNPmQbEJGYZlT8i:B1ssjXPCioEa8rpEi7pCBi3b1EEBi
TLSH	T161E3AE22B5F084E7D17AD3B0386B99777F2B6C08285C174B3350BFAA3E71647752A606
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b070e4f8dad4f819 (3 x GuLoader)
Reporter	openctibr
Tags:	exe GuLoader OpenCTI.BR Sandboxed signed

Code Signing Certificate

Organisation:	Specialiceret2 acclamation diskoskasters bibliofilt
Issuer:	Specialiceret2 acclamation diskoskasters bibliofilt
Algorithm:	sha256WithRSAEncryption
Valid from:	2022-07-14T06:12:55Z
Valid to:	2023-07-14T06:12:55Z
Serial number:	159280fb0794659f
Thumbprint Algorithm:	SHA256
Thumbprint:	33df0221c239222c96dbcba40fc18cdad0f50c19bcfef1e601edb8a165b37d6f
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

184

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d010423859b6cd275c967787b541dbb84e33f86263a8160bf1d0b27763336089.xlsx

Verdict:

Malicious activity

Analysis date:

2022-07-14 14:12:51 UTC

Tags:

encrypted opendir loader exploit CVE-2017-11882

Link:

https://app.any.run/tasks/1c733507-dfc5-4cb8-8c87-e07a377fadbc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/289268/

Detection(s):

SecuriteInfo.com.Trojan.NSIS.Agent.29251.13498.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Creating a file in the %temp% subdirectories

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/25169/overview

Behaviour

MalwareBazaar

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

buer overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/62d0dca83c475438b54863e3/reports/34e4fdcc-fbb4-4108-9853-7495b7ad8b32/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/5e273d05-1417-4656-9fbc-a385ae96c385

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1032260

Signature

C2 URLs / IPs found in malware configuration

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9703ca54765334af19f56357bbbda992a8d6fadc48052d15a46d68024ef2b2ec/

Threat name:

Win32.Downloader.GuLoader

Status:

Malicious

First seen:

2022-07-14 13:21:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

8 of 26 (30.77%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s4b4uvdwkm2k6gpvmnl3xpnjskunn6w4jacs2fnenvuaetxswlwa._file

Verdict:

suspicious

Result

Malware family:

guloader

Score:

10/10

Tags:

family:guloader discovery downloader

Link:

https://tria.ge/reports/220715-dtln7sgba6/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Drops file in Windows directory

Checks installed software on the system

Loads dropped DLL

Guloader,Cloudeye

Unpacked files

SH256 hash:

c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

MD5 hash:

792b6f86e296d3904285b2bf67ccd7e0

SHA1 hash:

966b16f84697552747e0ddd19a4ba8ab5083af31

Link:

https://www.unpac.me/results/f1d821da-8914-4b88-8fcc-58113ccadf69/

SH256 hash:

9703ca54765334af19f56357bbbda992a8d6fadc48052d15a46d68024ef2b2ec

MD5 hash:

f631fece402bf1af1bf1eeccd2462f1f

SHA1 hash:

4457c7db89366d2498d2a075360fa1c803ed4706

Link:

https://www.unpac.me/results/f1d821da-8914-4b88-8fcc-58113ccadf69/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9703ca54765334af19f56357bbbda992a8d6fadc48052d15a46d68024ef2b2ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.