MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99a048c63a4d6da2b9deff2adc8ade88bd4b999674a7fcaeb373fdf8f151ef65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99a048c63a4d6da2b9deff2adc8ade88bd4b999674a7fcaeb373fdf8f151ef65
SHA3-384 hash: 01cb29a7f13a0b5897dc83fe8e57c129e0c705c053559e615856e5fe19be38618a5ed3be525a7b955da735b384182ba7
SHA1 hash: 6394bfefd5b14c0b84a8cd394ffe7742f6b3838a
MD5 hash: ace5939002ec6aebf243bf859f68113a
humanhash: avocado-potato-leopard-violet
File name:New_000098899.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2020-05-20 12:24:13 UTC
Last seen:2020-05-20 13:17:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 81663145ab329d7c939bd737b72e9713 (1 x GuLoader)
ssdeep 1536:SyWMswCxnPzygkctsUYi8cqseA799hRy:aMEroxcr7o
Threatray 460 similar samples on MalwareBazaar
TLSH 39A30929FEA4DCA2EA2483FD5D554AA8465BFC348811CE0BB0CD7E1D25F36C5E065327
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.aspaityl.com
Sending IP: 45.95.169.151
From: Satheesh M <ptr.strelnik@mail.ru>
Subject: Order confirmation
Attachment: New_000098899.xls.z (contains "New_000098899.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Exesplitter-7
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 12:37:32 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tgqerrr2jvw2foo674vnzcw6rc6uxgmwost7zlvtop67r4kr55sq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
guloader
Create hunting rule
Similar samples:
07237097ff28d5ca9df13b6fb8021b423335d664bd3b539d00c1542bf032b5b0
GuLoader
4343e77b4710f4ea72e445b733076ba3495be7f1c94b88d73ff70b6f03711c3e
GuLoader
4fe45a8e07fc28eb30222f08219ca2bb8832220a97ff56333193bd422a876f0c
GuLoader
57c591ad1d83e9b2cd563ddf979d3d5f16c11532f6101c3547a843c9016a1b29
GuLoader
611086722efb829d07f7059226cd4a0ab3544945c63c622eb11133027517654e
GuLoader
7f29131cb5f28ccbd60dbdf39b6b3c79a974d4a3950aac1d1c0f7edd68193c03
GuLoader
7f62e5e2d0cfbe0740718588465b71a701fe3e188a8a4755baacbdc6fb41d52c
GuLoader
a860b7f6787c55f457249bf722d6ce93034391889c05f6ec0c9e10befe8c8c03
GuLoader
bc4d71c433212a94ba581d1ffbdbefcf696c47b9944fac63352350186559cf83
GuLoader
fe974cd55e593d754c3dca74db62bc2fb48f9144c7098eedcf3b9abad1fe05e2
GuLoader
+ 450 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer rat
Link:
https://tria.ge/reports/201109-cesb58r2bs/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent state file
Warzone RAT Payload
WarzoneRat, AveMaria
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

z cb6da2e25ac235cedd2abe341b601a2f1c66b6324594bf00d57209aba097d197

GuLoader

Executable exe 99a048c63a4d6da2b9deff2adc8ade88bd4b999674a7fcaeb373fdf8f151ef65

(this sample)

  
Dropped by
MD5 91fde186405fc48cd20099464d533d86
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 cb6da2e25ac235cedd2abe341b601a2f1c66b6324594bf00d57209aba097d197

Comments