MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a899d2b8f1cf3d0a97107dcfecafb3239cade9e8aad01fe007f3b0d8762b8b7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	a899d2b8f1cf3d0a97107dcfecafb3239cade9e8aad01fe007f3b0d8762b8b7a
SHA3-384 hash:	d58c32d1f0a2546425766b8cfbcb1cf20fb458d6ea52fa937866ae16aa8588e74a61258b75f3c7787b8e56db16bebfd6
SHA1 hash:	7d6f95b7c657fcbb11fc2fcefb50e9660306c0b0
MD5 hash:	d0a2ff7c606f8fbf489b3e595cdf349d
humanhash:	gee-undress-quebec-december
File name:	品目の照会-013872,pdf.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	989'698 bytes
First seen:	2020-05-01 13:34:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1c8a22c0423451ea1e4122bc2e70af18 (8 x GuLoader, 1 x RemcosRAT, 1 x AveMariaRAT)
ssdeep	12288:Ei2KmIpZ7l+/yO3VhZjgMU4eB7hqcXdSu7ecxBOPY4Jvjg3FVLg904yp4lFBQ:EFGl0ycAF1dSSeqBOPYovEZ4y+fQ
Threatray	787 similar samples on MalwareBazaar
TLSH	B425AF63B2C04877D0731E78DD1B93689827BD612A2468C677F53D4C9F393A13A3A297
Reporter	abuse_ch
Tags:	exe geo GuLoader JPN nVpn RAT

abuse_ch

Malspam distributing GuLoader:

HELO: server2-ip13.mailsentinel.net
Sending IP: 111.90.139.20
From: katotech@keskato.co.jp
Subject: 品目の照会-013872
Attachment: 品目の照会-013872,pdf.iso (contains "品目の照会-013872,pdf.exe")

GuLoader pushing RemcosRAT via drive.google.com

RemcosRAT C2:
experience2477.ddns.net:1965 (185.244.30.17)

Pointing to nvpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_Foundation_Hungary
remarks: Budapest, Hungary
country: HU
org: ORG-FOSF3-RIPE
admin-c: FOSF1-RIPE
tech-c: FOSF1-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-04-06T19:58:39Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Dropper.Remcos-7735852-0

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-01 03:43:15 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 31 (90.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vcm5fohrz46qvfyqpxh6zl5teook32pivlib7yah6oynq5rlrn5a._file

Verdict:

malicious

Label(s):

remcos

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso aa94a10b2d2a2b020aa7dd407df55d507b425c2c759efc9ec990f58b4ec803f6

GuLoader

exe a899d2b8f1cf3d0a97107dcfecafb3239cade9e8aad01fe007f3b0d8762b8b7a

(this sample)

Dropped by

MD5 228cb0396d163c396fbfab529db3af6b

Delivery method

Distributed via e-mail attachment

Dropped by

SHA256 aa94a10b2d2a2b020aa7dd407df55d507b425c2c759efc9ec990f58b4ec803f6

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteA
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::EmptyClipboard user32.dll::FindWindowA user32.dll::OpenClipboard user32.dll::PeekMessageA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample