MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 baf524e165268a0c661800a1f01547c21f6bb1c0d399c72ebbcd2a08cc797977. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: baf524e165268a0c661800a1f01547c21f6bb1c0d399c72ebbcd2a08cc797977
SHA3-384 hash: ca40bee0fa4200614c16bdd174e93c31bd160227e36a0dd1f9eb0f97ec74351edad5ea0be0b8a1071887ea07bdf1edc7
SHA1 hash: 50cb5fc894eb8f0d35fe2753ba022dcf21af7f9c
MD5 hash: 32242150aaa493a53c356b6f05006915
humanhash: freddie-salami-oranges-violet
File name:22-05-23 SENAL TRACTORA FIRMA 23-05-23.pdf.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:640'488 bytes
First seen:2023-05-22 10:26:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3abe302b6d9a1256e6a915429af4ffd2 (271 x GuLoader, 38 x Formbook, 25 x Loki)
ssdeep 12288:04+L3gMNEauRir739U+BXLDNenuY/woW/jn8C4ROKQiEE7GQ:a80EauRir7NU+lpen9Yo8YzROZfFQ
Threatray 663 similar samples on MalwareBazaar
TLSH T142D4E0023F2CA55DD5F9C6752747CBF60FA5BE2AC8F152CAB7C5731C68B85820A8E502
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 88a4c0c8d8d062be (3 x GuLoader, 3 x Formbook)
Reporter pr0xylife
Tags:AgentTesla exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
243
Origin country :
IE IE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
22-05-23 SENAL TRACTORA FIRMA 23-05-23.pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-05-22 10:28:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8c08c022-9d8b-4984-bf18-e03646408c78

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.BackDoor.HRDP.38.4359.6678.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Creating a file
Delayed reading of the file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer guloader lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/646b43760f421fdacd9cdbc1/reports/b67f056f-ad99-4982-8416-daa3678537e0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/baf524e165268a0c661800a1f01547c21f6bb1c0d399c72ebbcd2a08cc797977
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/40f2148c-430f-4700-b954-c1ba1851df23
Result
Threat name:
GuLoader, AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1239486
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected GuLoader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/baf524e165268a0c661800a1f01547c21f6bb1c0d399c72ebbcd2a08cc797977/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-05-22 10:24:54 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xl2sjylfe2fayzqyacq7afkhyipwxmoa2om4olv3zuvartdzpf3q._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
0c09174880f7ca0d0d521dfe118d5077c78270973a1437490f91b60c39095927
GuLoader
7025a565fe7b2b8a05477201f7dfdf8f2735dd056626aa0fbf6a949a4e61179f
GuLoader
723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef
GuLoader
b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338
GuLoader
c509b66c0755a4e9e7b7ad209f460f7765b6c06954c9c4f88f051c14cdbc1f6b
GuLoader
f04bcd88e4fc673e3c6a50fe97b68d93a35ee6a0029b4d1082aac6751c0b751d
GuLoader
f80dd0bf7402bebd03d303c97c8dd3f921d3e923a2521f4a2af2e4bf3c288aa1
GuLoader
+ 653 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:guloader collection discovery downloader keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230522-mg3lmaff57/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks QEMU agent file
Loads dropped DLL
AgentTesla
Guloader,Cloudeye
Malware Config
C2 Extraction:
https://api.telegram.org/bot2122434962:AAFqluKwJfwmfN8BZ9xq0IjlIijJbDmwbKs/
Unpacked files
SH256 hash:
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 hash:
fbe295e5a1acfbd0a6271898f885fe6a
SHA1 hash:
d6d205922e61635472efb13c2bb92c9ac6cb96da
Link:
https://www.unpac.me/results/20ccf5cd-0f22-4d8a-af20-18c8e6692387/
SH256 hash:
baf524e165268a0c661800a1f01547c21f6bb1c0d399c72ebbcd2a08cc797977
MD5 hash:
32242150aaa493a53c356b6f05006915
SHA1 hash:
50cb5fc894eb8f0d35fe2753ba022dcf21af7f9c
Link:
https://www.unpac.me/results/20ccf5cd-0f22-4d8a-af20-18c8e6692387/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/baf524e16526/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/baf524e165268a0c661800a1f01547c21f6bb1c0d399c72ebbcd2a08cc797977

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments