MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2ad5670f46f3be3f5bd5b6bd9d3122dad6a48664bad0e6f4418396e02ab8c00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f2ad5670f46f3be3f5bd5b6bd9d3122dad6a48664bad0e6f4418396e02ab8c00
SHA3-384 hash:	e6b62f7510adb103f7bb6218384cfe35f1b3c43f35f862117b4e204b0b372149835056ded39eb88b33f49a89b95e6c32
SHA1 hash:	bda490a4f2fb1afa38e1fab383717febccd2ac5a
MD5 hash:	adb5ba663773cefea80795266f2076d5
humanhash:	edward-fourteen-jupiter-cup
File name:	Türk Havacılık ve Uzay Sanayii AŞ TEKLİF TALEBİ_PDF.exe
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	536'715 bytes
First seen:	2023-12-04 09:12:54 UTC
Last seen:	2023-12-04 11:22:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	66fcdd6338ffed276966867e7cf86116 (9 x GuLoader, 2 x AgentTesla, 2 x RemcosRAT)
ssdeep	12288:ZaWwYQgC4tRFIBSxQoPWF6XGKmx0dhSxnyOvT:oWDnIBmQfSGKL6xyOr
TLSH	T1A3B4BE49E762DCF9FA6A1379257159123F41EC5F6099289C228DFA223C36313509BCFB
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	74e4d4d4ecf4d4d4 (23 x GuLoader, 20 x LummaStealer, 19 x AgentTesla)
Reporter	abuse_ch
Tags:	exe geo GuLoader TUR

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

306

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Malware-gen.27208.13521.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Creating a file in the Windows directory

Searching for the window

Сreating synchronization primitives

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Launching a process

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/f2ad5670f46f3be3f5bd5b6bd9d3122dad6a48664bad0e6f4418396e02ab8c00

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e251be4c-d175-413f-8979-e270f7a59a81

Joe Sandbox AgentTesla, GuLoader

Result

Threat name:

AgentTesla, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1352999

Signature

Antivirus detection for URL or domain

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Initial sample is a PE file and has a suspicious name

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: MSBuild connects to smtp port

Snort IDS alert for network traffic

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/f2ad5670f46f3be3f5bd5b6bd9d3122dad6a48664bad0e6f4418396e02ab8c00

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f2ad5670f46f3be3f5bd5b6bd9d3122dad6a48664bad0e6f4418396e02ab8c00/

ReversingLabs TitaniumCloud Win32.Trojan.GuLoader

Threat name:

Win32.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-04 08:35:38 UTC

File Type:

PE (Exe)

Extracted files:

10

AV detection:

15 of 37 (40.54%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6kwvm4hun456h5n5lnv5tuysfwwwusdgjowq432eda4w4avlrqaa._file

Threatray unknown

Verdict:

unknown

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader downloader

Link:

https://tria.ge/reports/231204-k6q8saab73/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Guloader,Cloudeye

UnpacMe

Unpacked files

SH256 hash:

f2ad5670f46f3be3f5bd5b6bd9d3122dad6a48664bad0e6f4418396e02ab8c00

MD5 hash:

adb5ba663773cefea80795266f2076d5

SHA1 hash:

bda490a4f2fb1afa38e1fab383717febccd2ac5a

Link:

https://www.unpac.me/results/3f1e17df-2859-4ac6-b261-74fd4f0d7803/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f2ad5670f46f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f2ad5670f46f3be3f5bd5b6bd9d3122dad6a48664bad0e6f4418396e02ab8c00