MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9c312936a88ac3629aa8fb5c4d6b5fe5fcad17319b825bf4b383fd807cb3f51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9c312936a88ac3629aa8fb5c4d6b5fe5fcad17319b825bf4b383fd807cb3f51
SHA3-384 hash: cde44b819ab93b4a716b2f6c271ecda2655b812a0f5302577697d49f527d0d38c4151a62fadcf7e5101fb52ae6f68ec6
SHA1 hash: efce7a2208777b322dc21925c2ee1a047796a563
MD5 hash: 76fa6c06defc4e273ad8fc1d317e1c66
humanhash: moon-timing-aspen-early
File name:SecuriteInfo.com.Variant.Midie.79534.16212.9524
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2021-03-03 23:46:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 05dcbee7bb2d3c59124fc0704fece83d (9 x GuLoader)
ssdeep 1536:Zj34nE8XVyDYNREu9CcZTli2H4mtZHJWN34nE8X:InNCilxYZ
Threatray 499 similar samples on MalwareBazaar
TLSH 28A3D81BAD7C4486D7234330D41EA9CA0266DF217E21B68AB484F63BDDB67E14678337
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
265
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Midie.79534.16212.9524
Verdict:
No threats detected
Analysis date:
2021-03-03 23:50:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2fc9a577-eda0-4337-9cdb-e7d0c926d33e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/122134/
Detection(s):
SecuriteInfo.com.Variant.Midie.79534.16212.9524.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NanoCore
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/627023
Signature
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Tries to detect Any.run
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 362497 Sample: SecuriteInfo.com.Variant.Mi... Startdate: 04/03/2021 Architecture: WINDOWS Score: 100 43 rhbavzcmkopdhunbsgwtfcvzcxgjhyegvbcnmgte.ydns.eu 2->43 51 Multi AV Scanner detection for domain / URL 2->51 53 Sigma detected: Scheduled temp file as task from temp location 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 3 other signatures 2->57 9 SecuriteInfo.com.Variant.Midie.79534.16212.exe 1 2->9         started        12 RegAsm.exe 1 2->12         started        14 dhcpmon.exe 2->14         started        signatures3 process4 signatures5 59 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 9->59 61 Tries to detect virtualization through RDTSC time measurements 9->61 16 RegAsm.exe 1 20 9->16         started        21 conhost.exe 12->21         started        23 conhost.exe 14->23         started        process6 dnsIp7 41 mtspsmjeli.sch.id 103.150.60.242, 49740, 80 PC24NET-AS-IDPTPC24TelekomunikasiIndonesiaID unknown 16->41 35 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 16->35 dropped 37 C:\Users\user\AppData\Local\...\tmpC505.tmp, XML 16->37 dropped 39 C:\Program Files (x86)\...\dhcpmon.exe, PE32 16->39 dropped 45 Tries to detect Any.run 16->45 47 Hides threads from debuggers 16->47 49 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->49 25 schtasks.exe 1 16->25         started        27 schtasks.exe 1 16->27         started        29 conhost.exe 16->29         started        file8 signatures9 process10 process11 31 conhost.exe 25->31         started        33 conhost.exe 27->33         started       
Detection:
guloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a9c312936a88ac3629aa8fb5c4d6b5fe5fcad17319b825bf4b383fd807cb3f51/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 17:28:00 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vhbrfe3krcwdmknkr624jvvv7zp4vultdg4clp2lha75qb6lh5iq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
250d4d5045162c39e3c1b9d637e0188089299a04106202afdf1f4826d24e27f4
GuLoader
3cbf0aeafec688023948cad7bf7475270ba9cb1acb0078cf1a9d6288f2751a20
GuLoader
479f929625a3e8a8f98256c3a020f5946e0d88fd7e3582e47b63500679d46585
GuLoader
522735989689a96d0e10e926aae941e58a695062254573c5796bb129e4c7703e
GuLoader
5c2766a9b8df935b6144459c3ae5c8f6b7cab54ab844cc78ae770ed1481c4220
GuLoader
6147decc439b9d258f5b19f77dfa47ea441e681c49e0b699533eea18104f4092
GuLoader
6e6fa2f1d1b7e3c37b6c7a18a4bd750e6ca980741c87af931c17d2ed7e469c3e
GuLoader
7765b39aa0345fd2af3838a548807c90094ea98d227d625ed742260833643b52
GuLoader
c3ca97abe1f0584928691bf13d02b25a4e20288a2477e466d67000c0bbe04df3
GuLoader
c6e5156c311412210237810450648947699d1c4862536a4e86b778e899627292
GuLoader
+ 489 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210303-lc7yabc8tn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
NanoCore
Malware Config
C2 Extraction:
rhbavzcmkopdhunbsgwtfcvzcxgjhyegvbcnmgte.ydns.eu:2486
Unpacked files
SH256 hash:
a9c312936a88ac3629aa8fb5c4d6b5fe5fcad17319b825bf4b383fd807cb3f51
MD5 hash:
76fa6c06defc4e273ad8fc1d317e1c66
SHA1 hash:
efce7a2208777b322dc21925c2ee1a047796a563
Link:
https://www.unpac.me/results/b83818a5-b283-46fc-85b9-8d1fe0ac3eba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9c312936a88ac3629aa8fb5c4d6b5fe5fcad17319b825bf4b383fd807cb3f51

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe a9c312936a88ac3629aa8fb5c4d6b5fe5fcad17319b825bf4b383fd807cb3f51

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1045052/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/122134/

Comments