MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e68d5ceca9a1135c2cb20a660d7d4807bb91cfd7f8ab0a3d8ba3e376dca8c2e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e68d5ceca9a1135c2cb20a660d7d4807bb91cfd7f8ab0a3d8ba3e376dca8c2e0
SHA3-384 hash:	3f10eb5f416c5372c64076ce9f5b3dc001e8b359d26e3a0c80a5d46bfc15e7043201f16acdbeaa2e72e3a971366b475a
SHA1 hash:	14784b0ed15bea3aa4164d278516ee9934b03c6a
MD5 hash:	3db16ffd68a4f0e879acb31c63f76ea9
humanhash:	nineteen-sodium-green-venus
File name:	E-dekont.exe
Download:	download sample
Signature	AZORult Alert Create hunting rule
File size:	1'087'681 bytes
First seen:	2023-10-03 18:19:23 UTC
Last seen:	2023-10-03 18:38:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e2a592076b17ef8bfb48b7e03965a3fc (419 x GuLoader, 63 x RemcosRAT, 52 x AgentTesla)
ssdeep	24576:LN9+kioQbfMsMkh/Uds0IoIb2DEV0X1z+At4Yw6ZbWQ:LN9+kimszhsds0U6g+X1z+K4bU
TLSH	T1073512537A948877C3860A7C4C19E7796A43BE64AC10896E3694FE9F3DF2352150E3EC
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	8c72c88cceec99c2 (3 x AZORult)
Reporter	abuse_ch
Tags:	AZORult exe geo TUR

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

336

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.NSIS.Agent.30139.15780.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %AppData% subdirectories

Delayed reading of the file

Сreating synchronization primitives

Creating a file in the %temp% subdirectories

Creating a file

Searching for the Windows task manager window

Sending a custom TCP request

Dragonfly

Gathering data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/651c5b5c4d45a517a34028c9/reports/796a269e-6362-4dbc-a79e-58b8f07fd110/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/e68d5ceca9a1135c2cb20a660d7d4807bb91cfd7f8ab0a3d8ba3e376dca8c2e0

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d2aa4d33-1369-403f-8694-cc882d74e091

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1318957

Signature

Antivirus / Scanner detection for submitted sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e68d5ceca9a1135c2cb20a660d7d4807bb91cfd7f8ab0a3d8ba3e376dca8c2e0/

ReversingLabs TitaniumCloud Win32.Trojan.Nemesis

Threat name:

Win32.Trojan.Nemesis

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-02 11:44:52 UTC

File Type:

PE (Exe)

Extracted files:

14

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=42gvz3fjuejvylfsbjta27kia65zdt6x7cvqupmluprxnxfiylqa._file

Threatray cloudeye

Verdict:

malicious

Label(s):

cloudeye

Alert

Create hunting rule

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:azorult family:guloader downloader infostealer trojan

Link:

https://tria.ge/reports/231003-wyrp5agf89/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks QEMU agent file

Loads dropped DLL

Azorult

Guloader,Cloudeye

UnpacMe 4

Unpacked files

SH256 hash:

c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7

MD5 hash:

b55f7f1b17c39018910c23108f929082

SHA1 hash:

1601f1cc0d0d6bcf35799b7cd15550cd01556172

Link:

https://www.unpac.me/results/26d9f9a8-9031-4808-a574-5724cd7a55e5/

SH256 hash:

e69ee897084fcdaf301b710386853fe867c9ed036222be44ba7b5a080e828ffb

MD5 hash:

1a6d0cfb6b904c4bf63491728ce9cf06

SHA1 hash:

ad29426b4888c0f23b758d42320e1ad6cd731133

Link:

https://www.unpac.me/results/26d9f9a8-9031-4808-a574-5724cd7a55e5/

SH256 hash:

4287790460fc94877160956aeb174cf2b2cd8df9675b23e26090a0c0cdaa4974

MD5 hash:

224454653e770e7b81f88ced2473b8ab

SHA1 hash:

a764ea8841b0cdf576aab7899154ff2576373d4d

Link:

https://www.unpac.me/results/26d9f9a8-9031-4808-a574-5724cd7a55e5/

SH256 hash:

e68d5ceca9a1135c2cb20a660d7d4807bb91cfd7f8ab0a3d8ba3e376dca8c2e0

MD5 hash:

3db16ffd68a4f0e879acb31c63f76ea9

SHA1 hash:

14784b0ed15bea3aa4164d278516ee9934b03c6a

Link:

https://www.unpac.me/results/26d9f9a8-9031-4808-a574-5724cd7a55e5/

VMRay GuLoader

Malware family:

GuLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e68d5ceca9a1/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.84

Link:

https://yomi.yoroi.company/submissions/e68d5ceca9a1135c2cb20a660d7d4807bb91cfd7f8ab0a3d8ba3e376dca8c2e0