MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8ae16bfa9525efdd82a2bcaf9b5d421761f6ceaeca12f05d8bbbe085eecd28a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8ae16bfa9525efdd82a2bcaf9b5d421761f6ceaeca12f05d8bbbe085eecd28a
SHA3-384 hash: 9bdfe65038c940c99df87072ee8129f3b321c3c5614322d14b5653ff4740bcec16518f4fa528dec8b21602a0ab254f55
SHA1 hash: 8ab827c9795b03b44ce41552ecb0ce7393742590
MD5 hash: 931abb11a96c159fb6fa61d20faba672
humanhash: winter-oxygen-mexico-enemy
File name:scan copy.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:167'544 bytes
First seen:2022-10-04 07:19:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ea4df5d94204fc550be1874e1b77ea7 (242 x GuLoader, 30 x RemcosRAT, 17 x VIPKeylogger)
ssdeep 3072:mAe+3aJpgWXTBuKfdwBVnYAp1PBy7LQ8PDU675YfOJES5sNSlBdwV/zjQfLga7:tB+pgUrKPYaPwwO5g4rsNMB+QEa7
TLSH T153F3F22922A1E827C9E38D716DFF962EDB74F1421A24670F23245F5D3D15382D80FB62
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter GovCERT_CH
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-06-02T14:27:57Z
Valid to:2025-06-01T14:27:57Z
Serial number: 46f12ab8f535aca1
Thumbprint Algorithm:SHA256
Thumbprint: 4b560bc2cc5675f8cb8935feecc6b973401f70e56f29d8c5ea13fa210824b70b
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
827
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316358/
Detection(s):
SecuriteInfo.com.W32.Trojan.PXES-4645.9406.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Delayed reading of the file
Searching for the window
Searching for the Windows task manager window
Running batch commands
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/41005/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/633bdea351afd00428a90adc/reports/d9b22e52-f44d-4fee-9374-f0a46fab5cf4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5aa8bb0b-84d1-4275-a88e-2c6f3e032ad7
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1083018
Signature
Machine Learning detection for sample
Mass process execution to delay analysis
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected GuLoader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 715575 Sample: scan copy.exe Startdate: 04/10/2022 Architecture: WINDOWS Score: 100 40 api.telegram.org 2->40 46 Snort IDS alert for network traffic 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected GuLoader 2->50 52 7 other signatures 2->52 8 scan copy.exe 53 2->8         started        signatures3 process4 file5 36 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->36 dropped 38 C:\Users\user\AppData\Local\...\System.dll, PE32 8->38 dropped 54 Obfuscated command line found 8->54 56 Writes to foreign memory regions 8->56 58 Tries to detect Any.run 8->58 12 CasPol.exe 15 11 8->12         started        16 cmd.exe 8->16         started        18 cmd.exe 8->18         started        20 62 other processes 8->20 signatures6 process7 dnsIp8 42 151.106.19.112, 49835, 80 VELIANET-ASvelianetInternetdiensteGmbHDE Germany 12->42 44 api.telegram.org 149.154.167.220, 443, 49836 TELEGRAMRU United Kingdom 12->44 60 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->60 62 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->62 64 Tries to steal Mail credentials (via file / registry access) 12->64 66 4 other signatures 12->66 22 conhost.exe 12->22         started        24 Conhost.exe 16->24         started        26 Conhost.exe 18->26         started        28 Conhost.exe 20->28         started        30 Conhost.exe 20->30         started        32 Conhost.exe 20->32         started        34 59 other processes 20->34 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8ae16bfa9525efdd82a2bcaf9b5d421761f6ceaeca12f05d8bbbe085eecd28a/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-03 09:57:25 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
23 of 41 (56.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vcxbnp5jkjpp3wbkfpfptnouef3b63hk5sqs6boyxo7aqxxm2kfa._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221004-h54flshbc3/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/66074bf9-08f3-42c2-aac4-bde57ab2b993
Unpacked files
SH256 hash:
7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
MD5 hash:
c5b9fe538654a5a259cf64c2455c5426
SHA1 hash:
db45505fa041af025de53a0580758f3694b9444a
Link:
https://www.unpac.me/results/3dd3f1c5-2241-4dd4-aef6-b1c500b36c94/
SH256 hash:
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 hash:
a4dd044bcd94e9b3370ccf095b31f896
SHA1 hash:
17c78201323ab2095bc53184aa8267c9187d5173
Link:
https://www.unpac.me/results/3dd3f1c5-2241-4dd4-aef6-b1c500b36c94/
SH256 hash:
8c6a95a1bf06c22224ab43bc1a1948f2cb0fd8d7089f2b828033c0fde161d2c2
MD5 hash:
d5bf01b2a316120d3d906e48e850520e
SHA1 hash:
a0e2f1caca1d35c227d231e6063d71ffe1d06322
Link:
https://www.unpac.me/results/3dd3f1c5-2241-4dd4-aef6-b1c500b36c94/
SH256 hash:
a8ae16bfa9525efdd82a2bcaf9b5d421761f6ceaeca12f05d8bbbe085eecd28a
MD5 hash:
931abb11a96c159fb6fa61d20faba672
SHA1 hash:
8ab827c9795b03b44ce41552ecb0ce7393742590
Link:
https://www.unpac.me/results/3dd3f1c5-2241-4dd4-aef6-b1c500b36c94/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/a8ae16bfa9525efdd82a2bcaf9b5d421761f6ceaeca12f05d8bbbe085eecd28a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe a8ae16bfa9525efdd82a2bcaf9b5d421761f6ceaeca12f05d8bbbe085eecd28a

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/316358/

Comments