MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4bb1c789100f6305c61e2be96351d53f20c091fa032948fcece3f73a29e0861. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d4bb1c789100f6305c61e2be96351d53f20c091fa032948fcece3f73a29e0861
SHA3-384 hash:	da5bf6477bbf18724d41fb44aa740d2dd95fd547ccb49d48718f64521100bbd46cda379b4f15b372eab76338992f10c6
SHA1 hash:	d8167d2ec7b794ec73f1500947f0e3c359113135
MD5 hash:	c6d4021705549f3150602665b7863d32
humanhash:	helium-mirror-idaho-bluebird
File name:	Halkbank.pdf.exe
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	330'197 bytes
First seen:	2023-07-08 08:26:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e2a592076b17ef8bfb48b7e03965a3fc (388 x GuLoader, 59 x RemcosRAT, 44 x VIPKeylogger)
ssdeep	6144:qhgqhwXoAoVHX2B5lb5pDBszce95aKhnE3/ZaIF62NjyIfHy:pqvVHX8l1rs4TKhE/Zaa6QyIfHy
Threatray	1'352 similar samples on MalwareBazaar
TLSH	T1DB64AE6B6B3A6912FD7C7031F6D6A5B367388CB15528B82232D0FE13187357B690E18D
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	ccf4d4dcdedee9b1 (4 x GuLoader)
Reporter	abuse_ch
Tags:	exe geo GuLoader Halkbank TUR

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

279

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Halkbank.pdf.exe

Verdict:

Malicious activity

Analysis date:

2023-07-08 08:27:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5dc23be9-4030-4771-964f-e105fa1f08c8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Guloader

Detection:

Guloader

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/411456/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Gen.Variant.Nemesis.25131.25090.20113.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a file

Delayed reading of the file

Creating a file in the %temp% subdirectories

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/96543/overview

Behaviour

MalwareBazaar

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/64a91dd79bd9f933fbb8ec09/reports/7b92a9ad-9506-479c-b8d7-10a0ec4e5376/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/d4bb1c789100f6305c61e2be96351d53f20c091fa032948fcece3f73a29e0861

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a1ea0a63-f31a-4baa-b68c-5c163af93747

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d4bb1c789100f6305c61e2be96351d53f20c091fa032948fcece3f73a29e0861/

ReversingLabs TitaniumCloud Win32.Trojan.Guloader

Threat name:

Win32.Trojan.Guloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-07 14:07:46 UTC

File Type:

PE (Exe)

Extracted files:

7

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2s5ry6erad3daxdb4k7jmni5kpzayci7uazjjd6ozy7xhiu6bbqq._file

Threatray cloudeye

Verdict:

malicious

Label(s):

cloudeye

Alert

Create hunting rule

Similar samples:

094dc63a99e7f4978723577fdbbbadc74ffa4b907368c0cd48b3d0b5f14e3fbc

GuLoader

3e742163144a721a8d6733f9653c2acca1638eced30159467a6768aff047f25c

GuLoader

569aa6697083993d9c387426b827414a7ed225a3dd2e1e3eba1b49667573fdcb

GuLoader

5708134963ec09acd66b22cf1115ec458151bdb151b5ecdeb69cca55081acadd

GuLoader

63e437a647e0cd76c38f1e73b5f1d5aa54c8e6a7f26cd31bd0fae9b1994751e9

GuLoader

65289cb664ec2a25e048267add52604e39d501fc71cd4de2def0cffabc59ccd8

GuLoader

7fa868c908374d9a48101bf8ed26b2f2c762773594106f176bd4ca279a91932c

GuLoader

ae40d89b95e9bb9432b002efa85faa423670e5fa79354e299098fd1a3d3f06fa

GuLoader

e5f05ae22cc0c8f9cf133127dde3e0ba142865e5d0ea7913df7574244f22b384

GuLoader

f582e0ab6415e885bf0a2036a2427fe0bc62d0316e26cd1b94c3b9066ed4a7bf

GuLoader

+ 1'342 additional samples on MalwareBazaar

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader discovery downloader

Link:

https://tria.ge/reports/230708-kcemwsea9z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks installed software on the system

Checks QEMU agent file

Checks computer location settings

Loads dropped DLL

Guloader,Cloudeye

UnpacMe 2

Unpacked files

SH256 hash:

982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

MD5 hash:

0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1 hash:

10c51496d37cecd0e8a503a5a9bb2329d9b38116

Link:

https://www.unpac.me/results/dcc710d8-30b3-4c9e-8fed-ab1dd7c744c5/

SH256 hash:

d4bb1c789100f6305c61e2be96351d53f20c091fa032948fcece3f73a29e0861

MD5 hash:

c6d4021705549f3150602665b7863d32

SHA1 hash:

d8167d2ec7b794ec73f1500947f0e3c359113135

Link:

https://www.unpac.me/results/dcc710d8-30b3-4c9e-8fed-ab1dd7c744c5/

VMRay GuLoader

Malware family:

GuLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d4bb1c789100/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d4bb1c789100f6305c61e2be96351d53f20c091fa032948fcece3f73a29e0861

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/411456/