MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6a5ea0d3e52c73c251ffe2da4955816885c20c3ad67d3f243544fd7b9b7e55d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	b6a5ea0d3e52c73c251ffe2da4955816885c20c3ad67d3f243544fd7b9b7e55d
SHA3-384 hash:	e1c0e3cf7aeb0da13af0eaa6f54658d8fe4b472670d87fa3da2635167be0d09cb20b707eabc200ffe233b1d6b581de81
SHA1 hash:	c8328effbf06bb6277cc728781921bb35930daf0
MD5 hash:	7e4c9587fcd16f21892e9414a88d752a
humanhash:	india-music-tennis-echo
File name:	New Order_pdf_0016534325.txz
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	1'420'598 bytes
First seen:	2025-02-05 11:49:38 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:4kYgi1qQ1DSDcgJZLU5Y9KWLcq7JxHmZbkYBDdjTrnooZYBr/6gBxYdTRSjpXi2h:4pnQQpCcgJi5iKWAq7JxHcpVdHrnoACl
TLSH	T1096533BC1FAFBA4705AFA1DE3791458EEE40755CA2C582B12EDE00152FCE27B495C278
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	GuLoader rar txz

cocaman

Malicious email (T1566.001)
From: "Kaspars Dainis<angela@novatron-cn.cam>" (likely spoofed)
Received: "from novatron-cn.cam (novatron-cn.cam [107.174.36.108]) "
Date: "5 Feb 2025 12:48:07 +0100"
Subject: "Request for New Order"
Attachment: "New Order_pdf_0016534325.txz"

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	New Order_pdf_006534325.exe
File size:	829'138 bytes
SHA256 hash:	7f2ad4dae501f03a420ec1971af3a5ebe539d7c3430dd632bb4dfa614aa82207
MD5 hash:	502a5d91b19d266d46f6bf270a3ce0c8
MIME type:	application/x-dosexec
Signature	GuLoader

File name:	New Order_pdf_0016534325.exe
File size:	841'524 bytes
SHA256 hash:	004a0e7dcc10446f8dffdf3474ee862f951850063bdf94e1fbfb81780597c0cd
MD5 hash:	bfe6e7e0438a127b3445d7a8afeab19b
MIME type:	application/x-dosexec
Signature	GuLoader

Vendor Threat Intelligence

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a351b52dcee78dd81981ec

Tags:

injection virus nsis

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/b6a5ea0d3e52c73c251ffe2da4955816885c20c3ad67d3f243544fd7b9b7e55d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b6a5ea0d3e52c73c251ffe2da4955816885c20c3ad67d3f243544fd7b9b7e55d/

Threat name:

Win32.Trojan.Zmutzy

Status:

Malicious

First seen:

2025-02-05 11:49:42 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

11 of 38 (28.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w2s6udj6kldtyji77yw2jfkyc2efyigdvvt5h4sdkrh5ponx4voq._file

Result

Malware family:

guloader

Score:

10/10

Tags:

family:guloader collection defense_evasion discovery downloader evasion spyware stealer trojan

Link:

https://tria.ge/reports/250205-sj53estlcl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Disables Task Manager via registry modification

Guloader family

Guloader,Cloudeye

Modifies Windows Defender DisableAntiSpyware settings

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b6a5ea0d3e52c73c251ffe2da4955816885c20c3ad67d3f243544fd7b9b7e55d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)