MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bcaac39113bd17158fe86a77328f97e9c3fa14860c9c4449a8ae0768c85243f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 10
| SHA256 hash: | bcaac39113bd17158fe86a77328f97e9c3fa14860c9c4449a8ae0768c85243f4 |
|---|---|
| SHA3-384 hash: | 625df0081ce57995719e03c93eadce990d9f634915f0e58d08af26563ac95e318c2c27aaa37f3673971b731bd985b317 |
| SHA1 hash: | ad379c5a86bf646c4a079e737a364ab352107e5b |
| MD5 hash: | ad0c93b574bb947cff15483eda82811e |
| humanhash: | uranus-river-early-fillet |
| File name: | ad0c93b574bb947cff15483eda82811e.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 379'720 bytes |
| First seen: | 2021-04-12 06:36:42 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 98f67c550a7da65513e63ffd998f6b2e (60 x Worm.Mofksys, 21 x SnakeKeylogger, 13 x MassLogger) |
| ssdeep | 6144:zvEN2U+T6i5LirrllHy4HUcMQY6ZOaoi7ru0qFkBYDoogRI30z0noojfIVAdayb1:zENN+T5xYrllrU7QY65oiHuhGYDoogR0 |
| Threatray | 5'501 similar samples on MalwareBazaar |
| TLSH | 1C84C566B509A02BD996D5F0316AF10AB1753D3206B99C1FBB90FF3A6070593B5BC30B |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Required Order Quantity.xlsx
Verdict:
Malicious activity
Analysis date:
2021-04-12 05:40:52 UTC
Tags:
encrypted trojan exploit CVE-2017-11882 loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file
Creating a process from a recently created file
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Setting a keyboard event handler
Setting a global event handler
Creating a file in the %AppData% directory
Setting a single autorun event
Launching the process to create tasks for the scheduler
Enabling autorun
Enabling a "Do not show hidden files" option
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook GuLoader
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to hide a thread from the debugger
Creates an undocumented autostart registry key
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found malware configuration
Hides threads from debuggers
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Potential malicious icon found
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected FormBook
Yara detected GuLoader
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Swisyn
Status:
Malicious
First seen:
2021-04-12 06:37:06 UTC
AV detection:
29 of 29 (100.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
avemaria
Similar samples:
+ 5'491 additional samples on MalwareBazaar
Result
Malware family:
guloader
Score:
10/10
Tags:
family:guloader downloader evasion guloader persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Modifies Installed Components in the registry
Guloader Payload
Guloader,Cloudeye
Modifies WinLogon for persistence
Modifies visiblity of hidden/system files in Explorer
Unpacked files
SH256 hash:
966b9b34ace3c324a0cfc816af437290ab2926f24bce8a50285f691418d1e308
MD5 hash:
fa6bb8f21659c6dd9b626ce85e4ea800
SHA1 hash:
02aa547c79794172fa359a15e1f54fb327cdcead
SH256 hash:
bcaac39113bd17158fe86a77328f97e9c3fa14860c9c4449a8ae0768c85243f4
MD5 hash:
ad0c93b574bb947cff15483eda82811e
SHA1 hash:
ad379c5a86bf646c4a079e737a364ab352107e5b
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [C0002.014] Communication Micro-objective::Read Header::HTTP Communication
2) [C0019] Data Micro-objective::Check String
3) [B0023] Execution::Install Additional Program