MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d6d6bd58488eb5f37fdba905ac0cb83e0cdb648ff2531cff16a76f2b2cbe5e84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | d6d6bd58488eb5f37fdba905ac0cb83e0cdb648ff2531cff16a76f2b2cbe5e84 |
|---|---|
| SHA3-384 hash: | 49606e0d26e93628f468259c221af18a76cdf6f86ee670135281e021ea6e9b2106d2b9a7597514d5cf240b950f716046 |
| SHA1 hash: | 7dd217e148061023ae75986fa4c24146c8ed6f7d |
| MD5 hash: | 94c98e7686ce0a56270cbd4e8b7b750e |
| humanhash: | ink-cup-low-rugby |
| File name: | po-0049205.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 572'418 bytes |
| First seen: | 2020-04-30 09:37:12 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 64ab6fd0cf28e70d3fb9a56a2dec328c (4 x RemcosRAT, 2 x GuLoader) |
| ssdeep | 12288:mPIhK2hqLgn3k6nDcqr7cwz8/0UTXOMOdSP:k6KnLgnxnDcq3u/3eC |
| Threatray | 894 similar samples on MalwareBazaar |
| TLSH | 72C48F23B2E14937D13B1A7C9C1B97A8AD3A7E113D28E8467BF42E4C4F396807539197 |
| Reporter |  abuse_ch |
| Tags: | exe geo GuLoader JPN nVpn RAT |
abuse_ch
Malspam distributing GuLoader:HELO: smtp97.iad3a.emailsrvr.com
Sending IP: 173.203.187.97
From: 東邦液化ガス株式会社 <yamauchi-jyunko@tohogas.co.jp>
Subject: 見積もり依頼
Attachment: po-0049205.zip (contains "po-0049205.exe")
GuLoader dropping unknown RAT.
RAT C2:
185.244.30.81:42017
Hosted at nvpn:
% Information related to '185.244.30.0 - 185.244.30.255'
% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'
inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_Foundation_Hungary
remarks: Budapest, Hungary
country: HU
org: ORG-FOSF3-RIPE
admin-c: FOSF1-RIPE
tech-c: FOSF1-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-04-06T19:58:39Z
source: RIPE
Intelligence
File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Remcos
Status:
Malicious
First seen:
2020-04-30 03:52:27 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
26 of 31 (83.87%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 884 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| COM_BASE_API | Can Download & Execute components | ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal |
| WIN32_PROCESS_API | Can Create Process and Threads | kernel32.dll::CloseHandle kernel32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA |
| WIN_BASE_IO_API | Can Create Files | kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA |
| WIN_REG_API | Can Manipulate Windows Registry | advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA |
| WIN_USER_API | Performs GUI Actions | user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::PeekMessageW user32.dll::CreateWindowExA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.