MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c409017de52a4a6ad3a0cd3ab97ad17f9be172136155bf548bef49d7777cec1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	c409017de52a4a6ad3a0cd3ab97ad17f9be172136155bf548bef49d7777cec1a
SHA3-384 hash:	ce39a0179a1fae3db873a128c8b494b73ad693668117ad6dd9794c1fd0204c9b3762eacd1854304d9218f2045f377173
SHA1 hash:	c6251f71a0a279ab3732b75e84093a54880ed914
MD5 hash:	593eb1753a4e1f12472da90eb370f9a1
humanhash:	hot-utah-shade-april
File name:	DHL_119040 receipt document,pdf.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	989'698 bytes
First seen:	2020-05-01 11:14:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1c8a22c0423451ea1e4122bc2e70af18 (8 x GuLoader, 1 x RemcosRAT, 1 x AveMariaRAT)
ssdeep	12288:Ei2KmIpZ7l+/yO3VhZjgMU4eB7hqcXd0L7ecxBOPY4Jvjg3FVLg904yp4lFQD:EFGl0ycAF1d0neqBOPYovEZ4y+iD
Threatray	891 similar samples on MalwareBazaar
TLSH	1425AF63B2C04877D0731E78DD1B93689827BD612A2468C677F53D4C9F393A13A3A297
Reporter	abuse_ch
Tags:	DHL exe GuLoader nVpn RAT RemcosRAT

abuse_ch

Malspam distributing GuLoader:

HELO: veeline.com
Sending IP: 103.227.62.236
From: DHL_119040 receipt document,pdf <delivery@dhl.com>
Subject: RE:DHL CARGO DELIVERY
Attachment: DHL_119040 receipt document,pdf.iso (contains "DHL_119040 receipt document,pdf.exe")

GuLoader pushing RemcosRAT from drive.google.com

RemcosRAT C2:
185.244.30.9:1960

Hosted on nvpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_Foundation_Hungary
remarks: Budapest, Hungary
country: HU
org: ORG-FOSF3-RIPE
admin-c: FOSF1-RIPE
tech-c: FOSF1-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-04-06T19:58:39Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Dropper.Remcos-7735852-0

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-01 01:45:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 31 (87.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yqeqc7pffjfgvu5azu5ls6wrp6n6c4qtmfk36vel55e5o5345qna._file

Verdict:

malicious

Label(s):

remcos

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 55e040e74e1010cbbd96411443e8864cb0c29085a9f6d0e9304c6bbda3facb17

GuLoader

exe c409017de52a4a6ad3a0cd3ab97ad17f9be172136155bf548bef49d7777cec1a

(this sample)

Dropped by

MD5 78f537ff0a404150fddd34bc3205ae82

Delivery method

Distributed via e-mail attachment

Dropped by

SHA256 55e040e74e1010cbbd96411443e8864cb0c29085a9f6d0e9304c6bbda3facb17

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteA
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::EmptyClipboard user32.dll::FindWindowA user32.dll::OpenClipboard user32.dll::PeekMessageA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample