MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8c89598bb45ed0ebe16aa01aab952fb83aae9c4c2752707d57adfe71a451057. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	b8c89598bb45ed0ebe16aa01aab952fb83aae9c4c2752707d57adfe71a451057
SHA3-384 hash:	49059359493952e9c50677301613ad491a79badf06aca319ff94958eee4da20a5e93026ac9d2b8c6e73d37bdf2bf5ecf
SHA1 hash:	02773217a0042fcace86326919d33d658eb056a4
MD5 hash:	2c0d2b900265a68818ec5877efed8123
humanhash:	hydrogen-river-moon-mobile
File name:	2023 February Request for Quotation.rar
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	289'723 bytes
First seen:	2023-02-16 08:00:02 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:tIlJ/99LzSEygy1FdN1H8y2YXXH4OdNmZxUY/BdMRrZbJx58v7VVvBz:tIPLz7ynbXHnmZ+YZdMRhbWvPBz
TLSH	T19C5423D48E03C75ED261879B16612D7E6708C42BC8498125EEF983EEDCA081ECF69DD3
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	QUOTATION rar RFQ

cocaman

Malicious email (T1566.001)
From: "admin1@voltronic.com.tw" (likely spoofed)
Received: "from ns-1052.awsdns-03.org (unknown [65.60.40.102]) "
Date: "15 Feb 2023 16:52:40 -0600"
Subject: "RFQ - February order"
Attachment: "2023 February Request for Quotation.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	2023 February Request for Quotation.exe
File size:	477'112 bytes
SHA256 hash:	0fc5e945316b1be00f0fdf8db159fb3613b2d607e4f7ed709658fe48fd7c83d7
MD5 hash:	305e9d78aff9e2ed540219d2ddcfbe4d
MIME type:	application/x-dosexec
Signature	GuLoader

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

buer guloader overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/63ede2888b045c831fba12e3/reports/b6cbdc54-3d75-4716-a706-4731f94ddf3b/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/b8c89598bb45ed0ebe16aa01aab952fb83aae9c4c2752707d57adfe71a451057

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b8c89598bb45ed0ebe16aa01aab952fb83aae9c4c2752707d57adfe71a451057/

Threat name:

Win32.Trojan.GuLoader

Status:

Malicious

First seen:

2023-02-16 01:55:08 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 25 (72.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xdejlgf3ixwq5pqwvia2voks7ob2v2oeyj2sob6vplp6ogsfcblq._file

Result

Malware family:

guloader

Score:

10/10

Tags:

family:guloader discovery downloader

Link:

https://tria.ge/reports/230216-kw669age5t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks installed software on the system

Checks QEMU agent file

Loads dropped DLL

Guloader,Cloudeye

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.43

Link:

https://yomi.yoroi.company/submissions/b8c89598bb45ed0ebe16aa01aab952fb83aae9c4c2752707d57adfe71a451057

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.