MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash:	a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404
SHA3-384 hash:	dcc6bb68e5d9f7b11327e6d514076b6dacfccdc5b3e058992c73c066a7f1514162f7765283c43127112cc5c22c8c28b2
SHA1 hash:	cc59c2f0d3b4ad9cebdca36ede5182f6746cff87
MD5 hash:	17eb8202cd25ebfb49eb1347ddbbe1d1
humanhash:	summer-item-double-potato
File name:	Purchase Order2883.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	790'560 bytes
First seen:	2024-08-26 05:40:15 UTC
Last seen:	2024-08-26 06:24:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	dd68e663380c71f66b512f005f1be7ec (15 x GuLoader, 3 x Formbook, 3 x VIPKeylogger)
ssdeep	12288:I1xZkxtCt777js4n4OdpvhVlp/+sH2WDAqQnm:I1xmCtLbBvpRH2WkqQm
Threatray	88 similar samples on MalwareBazaar
TLSH	T195F4E043FB40C086D56903F088BF9A406275EDA0EBC3174B7E49F7860DB3696F95A19B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	30d2d27290f662e0 (3 x GuLoader)
Reporter	abuse_ch
Tags:	exe GuLoader signed

Code Signing Certificate

Organisation:	Ancher
Issuer:	Ancher
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-11-25T01:37:03Z
Valid to:	2026-11-24T01:37:03Z
Serial number:	56e3cc17c24d1dd0f2810802894df4f74b04840a
Thumbprint Algorithm:	SHA256
Thumbprint:	07e9760babd8504aba0e1edb38c201b7fac7c09b2cb766ffc1d2ff08794c389e
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

402

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Purchase Order2883.exe

Verdict:

No threats detected

Analysis date:

2024-08-26 05:43:23 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e080026a-6a6b-4988-88a4-056ebd5dc506

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.Malware-gen.10937.24845.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66cc1573e7ff3f5a063bf9dd

Tags:

Encryption Generic Static Malware

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% subdirectories

Delayed reading of the file

Creating a file

Creating a file in the Windows subdirectories

Searching for the window

Creating a file in the %temp% subdirectories

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5c2b916f-64d4-4ba0-8c5a-9854c5bb25a5

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1498864

Signature

Antivirus detection for URL or domain

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Switches to a custom stack to bypass stack traces

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404/

Threat name:

Win32.Trojan.GuLoader

Status:

Malicious

First seen:

2024-06-30 13:02:48 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u7hbidisvy5sdafc6fyl3hhycibuarvvwtncxqdskjaeiuteuqca._file

Verdict:

malicious

Label(s):

cloudeye

GuLoader

82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e

GuLoader

9a7c3bc625eea7307bd041fb39917b7562a6f1e6f24c3a1e1419ebef9a800aab

GuLoader

f797957066f7df06f719849951c278e9c5f56a225f6d68ee352a14539579d8af

GuLoader

+ 78 additional samples on MalwareBazaar

Result

Malware family:

guloader

Score:

10/10

Tags:

family:guloader discovery downloader

Link:

https://tria.ge/reports/240826-gdfd2axgra/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Loads dropped DLL

Guloader,Cloudeye

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e3f50a1e-4c43-4624-93de-abd26b564847

Unpacked files

SH256 hash:

90f3cebb5b3759eb1bd72cee7cd8b694440ee398fe970b763db7a7b67208e4c8

MD5 hash:

8508fa0ab17e36e071687243283c2aef

SHA1 hash:

d45391d0454fbb9eb66fa72ecf0e2cadf0522bfe

Link:

https://www.unpac.me/results/6a736d99-238f-4ca9-90b0-af01fa452d09/

SH256 hash:

608364aa628004d02d786e961b6fe3d04addeee7892d393871f71241cdf3137f

MD5 hash:

3032c25dd603e66c040dce56f73de8d3

SHA1 hash:

9393ba163219bf0913c1b6b13a42bad7ad69916c

Link:

https://www.unpac.me/results/6a736d99-238f-4ca9-90b0-af01fa452d09/

SH256 hash:

a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404

MD5 hash:

17eb8202cd25ebfb49eb1347ddbbe1d1

SHA1 hash:

cc59c2f0d3b4ad9cebdca36ede5182f6746cff87

Link:

https://www.unpac.me/results/6a736d99-238f-4ca9-90b0-af01fa452d09/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NSIS_GuLoader Create hunting rule
Author:	NDA0E
Description:	Detects GuLoader using NSIS

Rule name:	NSIS_GuLoader_July_2024 Create hunting rule
Author:	NDA0E
Description:	Detects GuLoader packed with NSIS installer

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExA SHELL32.dll::SHFileOperationA SHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessA ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryExA KERNEL32.dll::GetDiskFreeSpaceA KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileA KERNEL32.dll::CreateDirectoryA KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileA KERNEL32.dll::MoveFileA KERNEL32.dll::MoveFileExA
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExA ADVAPI32.dll::RegDeleteKeyA ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegQueryValueExA ADVAPI32.dll::RegSetValueExA
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuA USER32.dll::EmptyClipboard USER32.dll::FindWindowExA USER32.dll::OpenClipboard USER32.dll::PeekMessageA USER32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample