MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8c03f50ff8217b8e4fe7e650360a566003875d0a943af2f2b3b895908872e4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 4 File information Comments

SHA256 hash:	a8c03f50ff8217b8e4fe7e650360a566003875d0a943af2f2b3b895908872e4a
SHA3-384 hash:	7b58a7a9fe2c6670114ff44f4a8370baeab99570023eaabaed27b80668f0e1b2824b330166f3bc6727eaa05f6e6983cc
SHA1 hash:	374fc9ab749ad634e284eb03c2c164a1d5fb7260
MD5 hash:	dddfc5bf7599ae2aacd87640404f585d
humanhash:	stream-october-winter-comet
File name:	rechnung.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	156'103 bytes
First seen:	2020-06-02 16:01:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6e52c12e62f8234e4c7d20aad0bc5957 (1 x GuLoader)
ssdeep	3072:JUG5Hyec1gqqK2lQBV+UdE+rECWp7hKNM:JNhfdQBV+UdvrEFp7hKG
Threatray	280 similar samples on MalwareBazaar
TLSH	94E38C036A0883E8D52445703F1B6B692BD4BC3C458F174BA6422E47FF7DB62798DA1E
Reporter	abuse_ch
Tags:	DEU exe geo GuLoader

abuse_ch

Malspam distributing GuLoader:

HELO: CEN-YCO-Rutalia-003.hispaweb.net
Sending IP: 109.70.131.174
From: Dr. Chris Jones <drchris-jones@outlook.com>
Reply-To: chris-jones@joneschris.tech
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 2-06-20 Rechnung_20-613129926-001
Attachment: Rechnung.zip (contains "rechnung.exe")

GuLoader payload URL:
http://156.96.118.179/slxslx-2RAW_gwKBF147.bin

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/6161/

Detection(s):

MiscreantPunch.SingleXOR.EXE.197.UNOFFICIAL

Gathering data

Threat name:

Win32.Virus.Floxif

Status:

Malicious

First seen:

2020-06-02 16:36:04 UTC

AV detection:

29 of 31 (93.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vdad6uh7qil3rzh6pzsqgyffmyadq5oqvfb26lzlhoevscehfzfa._file

Verdict:

malicious

Label(s):

guloader

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence upx

Link:

https://tria.ge/reports/201109-bhtr819ebj/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Drops file in Program Files directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

UPX packed file

Modifies AppInit DLL entries

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Malware_Floxif_mpsvc_dll Create hunting rule
Author:	Florian Roth
Description:	Malware - Floxif
Reference:	Internal Research

Rule name:	MAL_Floxif_Generic Create hunting rule
Author:	Florian Roth
Description:	Detects Floxif Malware
Reference:	Internal Research

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	SUSP_Microsoft_Copyright_String_Anomaly_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Floxif Malware
Reference:	Internal Research