MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0a39c9667944f066ff4d59094a1cad331587236ea385d4ecc48b647236ad427. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0a39c9667944f066ff4d59094a1cad331587236ea385d4ecc48b647236ad427
SHA3-384 hash: bade1ed993e02bada08884f1e6fff69a1b33020715f1e0a4bbdff241b0f730df66641f3cdd68beaeaac4d47e5dbc1aae
SHA1 hash: 4b825c8c20c58ab6d109035d0168af633cefbca7
MD5 hash: 0f1a5666c9775d2b44dda70de661bb7d
humanhash: oklahoma-west-vermont-south
File name:0f1a5666c9775d2b44dda70de661bb7d.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2021-02-18 07:09:53 UTC
Last seen:2021-02-18 09:59:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 28cfb83efbb0b6bd426b66f31651da5c (16 x GuLoader, 1 x RemcosRAT)
ssdeep 1536:ug0+Rd+TotduPhWqdRiz3L736JdWSoZKfR6zuE:rdIPJ5R8L7qHWSA
Threatray 861 similar samples on MalwareBazaar
TLSH EBA3C672B990D9F6E24480314456F7AD4627BF328840AD1FBDCCBE5E5E77AC29090D2B
Reporter abuse_ch
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://mtspsmjeli.sch.id/Img/CIZ.exe
Verdict:
No threats detected
Analysis date:
2021-02-18 00:32:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bbbf3322-9234-4f3e-b7a2-ec45f3d7a70a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Razy.843298.9451.26053.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/611128
Signature
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected GuLoader
Yara detected Remcos RAT
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 354587 Sample: LdOgPDsMEf.exe Startdate: 18/02/2021 Architecture: WINDOWS Score: 100 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected GuLoader 2->51 53 Yara detected Remcos RAT 2->53 55 4 other signatures 2->55 10 LdOgPDsMEf.exe 1 2->10         started        13 win.exe 1 2->13         started        15 win.exe 1 2->15         started        process3 signatures4 65 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 10->65 67 Tries to detect Any.run 10->67 69 Tries to detect virtualization through RDTSC time measurements 10->69 71 Contains functionality to hide a thread from the debugger 10->71 17 LdOgPDsMEf.exe 4 10 10->17         started        73 Hides threads from debuggers 13->73 22 win.exe 6 13->22         started        24 win.exe 6 15->24         started        process5 dnsIp6 43 mtspsmjeli.sch.id 103.150.60.242, 49728, 49732, 49734 PC24NET-AS-IDPTPC24TelekomunikasiIndonesiaID unknown 17->43 39 C:\Users\user\AppData\Roaming\win.exe, PE32 17->39 dropped 41 C:\Users\user\...\win.exe:Zone.Identifier, ASCII 17->41 dropped 57 Tries to detect Any.run 17->57 59 Hides threads from debuggers 17->59 26 wscript.exe 1 17->26         started        file7 signatures8 process9 process10 28 cmd.exe 1 26->28         started        process11 30 win.exe 1 28->30         started        33 conhost.exe 28->33         started        signatures12 75 Multi AV Scanner detection for dropped file 30->75 77 Machine Learning detection for dropped file 30->77 79 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 30->79 81 3 other signatures 30->81 35 win.exe 2 7 30->35         started        process13 dnsIp14 45 wedsazxcvfghyuiokjhbnvfcdsaweyplmhbvrtud.ydns.eu 46.243.248.168, 1996, 49733 M247GB Netherlands 35->45 47 mtspsmjeli.sch.id 35->47 61 Tries to detect Any.run 35->61 63 Hides threads from debuggers 35->63 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0a39c9667944f066ff4d59094a1cad331587236ea385d4ecc48b647236ad427/
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 03:07:12 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wcrzzfthsrhqm37u2wijjiok2myvq4rw5i4f2twmjc3eoi3k2qtq._file
Verdict:
suspicious
Similar samples:
0227a18d51d1cb1aa73f6df961aad10fddb22bc9894d482c7963b4b7a96cac0b
GuLoader
0a900513fd190b7909aa84a3581394ef6f4db574fb7c22ce834665751301c922
GuLoader
0ccd2b06984be7ae1ca2c2957f1c0479310ecddd4f518f604fbb2892bce86e89
GuLoader
6147decc439b9d258f5b19f77dfa47ea441e681c49e0b699533eea18104f4092
GuLoader
91db926d13bb0137347991e30a1ccd093e535ff375e102bfd44d9aae15650d21
GuLoader
abd1efbc5426f71f61487986b017c56c6e4d88a7c059cb77284b30607965722f
GuLoader
bbab8de2b5423859a65ec7bd98d6200c7e82798851c6fbb48bac1119da8bb5ed
GuLoader
c1dbce8cb6b99530955741665e3367229be0031fa420c1eafb9eb97faccf6440
GuLoader
c3935d8d7f8242fcba2abf1097257efc849949dd2e3abea70e57957243436e63
GuLoader
deb7f6e76d0d27a58d7eb53380b8f399d81caa842fe188830327b9aad82afdb0
GuLoader
+ 851 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210218-hrhpx7e836/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
b0a39c9667944f066ff4d59094a1cad331587236ea385d4ecc48b647236ad427
MD5 hash:
0f1a5666c9775d2b44dda70de661bb7d
SHA1 hash:
4b825c8c20c58ab6d109035d0168af633cefbca7
Link:
https://www.unpac.me/results/191d3681-4050-4594-a2dc-cd47680c8cce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.89
Link:
https://yomi.yoroi.company/submissions/b0a39c9667944f066ff4d59094a1cad331587236ea385d4ecc48b647236ad427

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe b0a39c9667944f066ff4d59094a1cad331587236ea385d4ecc48b647236ad427

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1017053/
  
Delivery method
Distributed via web download

Comments