MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b52df0859f182ec0325472d6cf1f9a532fa52a93f391308a23b9a23be1f2ab2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b52df0859f182ec0325472d6cf1f9a532fa52a93f391308a23b9a23be1f2ab2a
SHA3-384 hash: 54d66095b90ee1c95f1748a8a55440a450e965726dc09cb839bd4fb357b92c9b1109af660d9a2f22665a620b6e442dfe
SHA1 hash: ac18f0404721d705b1570b6747748318fa438cfe
MD5 hash: 2117c87773fdc37c7468fedf5cd7d416
humanhash: mars-tennessee-venus-monkey
File name:RFQ # 102003889.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:669'184 bytes
First seen:2020-10-09 06:02:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 526c0f274df58763f4b5b74cc1aa8506 (5 x Loki, 4 x 404Keylogger, 2 x MassLogger)
ssdeep 12288:ddUTWK/dyJQU71SjXIOHuaNspkXIGq8OTjhGh:d2BkJQjjdvwYtOK
Threatray 11'328 similar samples on MalwareBazaar
TLSH 4BE48E23E2E04437C1731A7D9C1F5BB4DE35BE102928A94A6BF4DE4C9F397907929293
Reporter abuse_ch
Tags:Endurance exe GuLoader


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: Bindig, Sebastian <sebastian.bindig@stayntechman.com>
Subject: PRICE & DELIVERY
Attachment: RFQ 102003889.pdf.z (contains "RFQ # 102003889.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69409/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Result
Threat name:
AgentTesla GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/486280
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides threads from debuggers
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Agent Tesla Trojan
Yara detected AgentTesla
Yara detected GuLoader
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 295587 Sample: RFQ # 102003889.exe Startdate: 09/10/2020 Architecture: WINDOWS Score: 100 23 checkip.us-east-1.prod.check-ip.aws.a2z.com 2->23 25 checkip.check-ip.aws.a2z.com 2->25 27 checkip.amazonaws.com 2->27 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 12 other signatures 2->51 9 RFQ # 102003889.exe 2->9         started        signatures3 process4 signatures5 61 Maps a DLL or memory area into another process 9->61 12 RFQ # 102003889.exe 1 9->12         started        process6 signatures7 63 Tries to detect Any.run 12->63 65 Hides threads from debuggers 12->65 15 RFQ # 102003889.exe 6 12->15         started        process8 dnsIp9 33 googlehosted.l.googleusercontent.com 216.58.208.129, 443, 49740 GOOGLEUS United States 15->33 35 192.168.2.1 unknown unknown 15->35 37 doc-0c-3k-docs.googleusercontent.com 15->37 39 Tries to detect Any.run 15->39 41 Maps a DLL or memory area into another process 15->41 43 Hides threads from debuggers 15->43 19 RFQ # 102003889.exe 16 15->19         started        signatures10 process11 dnsIp12 29 enmark.com.my 110.4.45.145, 49749, 49753, 587 EXABYTES-AS-APExaBytesNetworkSdnBhdMY Malaysia 19->29 31 mail.enmark.com.my 19->31 53 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->53 55 Tries to steal Mail credentials (via file access) 19->55 57 Tries to harvest and steal ftp login credentials 19->57 59 Tries to harvest and steal browser information (history, passwords, etc) 19->59 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b52df0859f182ec0325472d6cf1f9a532fa52a93f391308a23b9a23be1f2ab2a/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 18:07:48 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wuw7bbm7daxmamsuollm6h42kmx2kkut6oitbcrdxgrdxypsvmva._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
guloader
Create hunting rule
Similar samples:
2bb3ec5f6e8830a1b8e87a95bcb53406688386e7dd33149bb8117318f28faba9
GuLoader
4f8130693067523c153d09b000e48e744ca3b86388221a840349746ea6e561df
GuLoader
554da92aa0dff594ff82094b0a8e8125419723e8899c670f7b8d74daf0580880
GuLoader
57d8c785d274b5dad9441ec2211c49ef5fd5abef5ebb5275f9dd6b8e8ecfff21
GuLoader
7c15dd07b223275e68dd8034583f12a73fc19f2d42abede56ed8d0dfdc92edc6
GuLoader
a3cae0aae6bb5a0d6b4710e161925a315fd3ef4a5bfef88eea9fee94b35874d4
GuLoader
a9abad7f4aace35de5651f437a83f47787606345d04ea63426db6a7a9b02ba5e
GuLoader
b1667a4eee2a104e32fd9071a6de2ee27634d2e181350b329d58f54b12bd2931
GuLoader
cb13103e3eea22e8a647dd2fbf265c728b6360b15a0c46eb5b287c26acdd2c7d
GuLoader
ee5fd99c7fc747944fc82337291094b744fca1f9f6328551ba0f10a9f025ad52
GuLoader
+ 11'318 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201009-bnts1mbsms/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
b52df0859f182ec0325472d6cf1f9a532fa52a93f391308a23b9a23be1f2ab2a
MD5 hash:
2117c87773fdc37c7468fedf5cd7d416
SHA1 hash:
ac18f0404721d705b1570b6747748318fa438cfe
Link:
https://www.unpac.me/results/017453c2-c91a-48eb-9973-9b483d0184d9/
SH256 hash:
2d49928c21e9b29033f26d539b1f333493b74ef3f76482382ff0c0b249aa2c58
MD5 hash:
861d80b8d45c5adeab178c235bfd2ba9
SHA1 hash:
e03bcb7bbc871d4cf7d4106e2586d7b88e1710d7
Link:
https://www.unpac.me/results/017453c2-c91a-48eb-9973-9b483d0184d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b52df0859f182ec0325472d6cf1f9a532fa52a93f391308a23b9a23be1f2ab2a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

z 9ed08d20030a723fe1d4fa18d64cd44d42c94c240d39632cd90aa0b404c44bcd

GuLoader

Executable exe b52df0859f182ec0325472d6cf1f9a532fa52a93f391308a23b9a23be1f2ab2a

(this sample)

  
Dropped by
MD5 dd80208e8540a70778bda255b76cad50
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/69409/
  
Dropped by
SHA256 9ed08d20030a723fe1d4fa18d64cd44d42c94c240d39632cd90aa0b404c44bcd

Comments