MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b380861d3a6700f0270709b27f65394e4146f6a109512c084a71c14f69a57bfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b380861d3a6700f0270709b27f65394e4146f6a109512c084a71c14f69a57bfe
SHA3-384 hash:	38ff1e4388d443fd3aac0868591a870cbcc625ed2934a87f923241d92ddac511f99ed5a0992b0bf1ff9fdb6b83774062
SHA1 hash:	ce156705016ff9eef495a6b19914f9226b4d4f9d
MD5 hash:	a2978a29e462326c97fbf43f7614e30a
humanhash:	angel-winner-connecticut-yankee
File name:	Al Reem Maintenance for Pipes_pdf.bat
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	1'889'987 bytes
First seen:	2023-12-07 16:50:50 UTC
Last seen:	2023-12-07 18:18:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (527 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	49152:s9grOfMfGso2oUtAIAQQg7AnkWDnN19Ein/bfIoqC5:2g36Kl8kmzDzI
TLSH	T18D953321DB648231EEB348766077513BEEF68CB70095999B0B50FE4FFBB1242D70A259
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	e9f0c8eae2e8ec69 (2 x GuLoader)
Reporter	abuse_ch
Tags:	bat exe GuLoader

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

324

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/463311/

ClamAV Detected

Detection(s):

SecuriteInfo.com.W32.Trojan.UNGY-8773.5725.7837.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a file in the %AppData% subdirectories

Creating a file in the %temp% subdirectories

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/6571f7fcbb9490c89ccacf41/reports/b3b3d18b-db90-4935-9560-5b63ec4700ec/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/b380861d3a6700f0270709b27f65394e4146f6a109512c084a71c14f69a57bfe

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/222028c4-f025-4545-ab10-24f0f779da20

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1355633

Signature

Antivirus / Scanner detection for submitted sample

Initial sample is a PE file and has a suspicious name

Tries to detect virtualization through RDTSC time measurements

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

53%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/b380861d3a6700f0270709b27f65394e4146f6a109512c084a71c14f69a57bfe

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b380861d3a6700f0270709b27f65394e4146f6a109512c084a71c14f69a57bfe/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-07 09:20:41 UTC

File Type:

PE (Exe)

Extracted files:

21

AV detection:

13 of 23 (56.52%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=woaimhj2m4apajyhbgzh6zjzjzaun5vbbfisycckohau62nfpp7a._file

Threatray malicious

Verdict:

malicious

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231207-vc4xwsdg54/

Behaviour

Enumerates physical storage devices

Drops file in Program Files directory

Legitimate hosting services abused for malware hosting/C2

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

MD5 hash:

75ed96254fbf894e42058062b4b4f0d1

SHA1 hash:

996503f1383b49021eb3427bc28d13b5bbd11977

Link:

https://www.unpac.me/results/b3ff2274-5662-45d2-8cc4-ba1d41672f79/

SH256 hash:

b380861d3a6700f0270709b27f65394e4146f6a109512c084a71c14f69a57bfe

MD5 hash:

a2978a29e462326c97fbf43f7614e30a

SHA1 hash:

ce156705016ff9eef495a6b19914f9226b4d4f9d

Link:

https://www.unpac.me/results/b3ff2274-5662-45d2-8cc4-ba1d41672f79/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b380861d3a6700f0270709b27f65394e4146f6a109512c084a71c14f69a57bfe

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

exe b380861d3a6700f0270709b27f65394e4146f6a109512c084a71c14f69a57bfe

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/463311/