MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679
SHA3-384 hash: 85176577bb7ced839eeedf022aad4dfed53f4c5e7b8691a305281b65cf7bb5c38fadc6b9d7df93f510e9e9d3a746c649
SHA1 hash: cee3b32cbbcec87c7393a066012e6a2479867d4f
MD5 hash: e95742503cd258666b61c5dde8a9003a
humanhash: floor-black-july-leopard
File name:e95742503cd258666b61c5dde8a9003a
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'273'800 bytes
First seen:2023-06-08 06:49:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3abe302b6d9a1256e6a915429af4ffd2 (269 x GuLoader, 38 x Formbook, 25 x Loki)
ssdeep 24576:7Pw6DkT6kfGME6G3VibpHIdebodR6jlKFtQVUv+iP8o79bO+s:75gTvG32poHRS2tQuWikK9js
Threatray 1'580 similar samples on MalwareBazaar
TLSH T14A45239279D0CAC6E40802F01EF3C5A665797C201C9BB687B1CDB7AFD636446DC19ACE
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter zbetcheckin
Tags:32 exe GuLoader signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2023-01-25T09:05:25Z
Valid to:2026-01-24T09:05:25Z
Serial number: 4d2e5991f5373826cb5d2de5a485100d428690d8
Thumbprint Algorithm:SHA256
Thumbprint: d1ba955c6182983172debba827a86b364893e39ece64a6a8269022e8fc6bb347
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3abfcd50698f63ec13889697874b0dfd
Verdict:
Malicious activity
Analysis date:
2023-06-08 04:39:25 UTC
Tags:
opendir exploit cve-2017-11882 loader
Link:
https://app.any.run/tasks/541ad7cf-386b-4789-ae9e-7eedd6216c08

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/396804/
Detection(s):
SecuriteInfo.com.Adware.Downware.19579.26308.2454.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% subdirectories
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/89905/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/64817a1bb941c5c62d6226b0/reports/50a81df4-c176-4c94-856a-9c377ff1a8e8/overview
Verdict:
Malicious
Labled as:
Generik.NUWTBHL trojan
Link:
https://www.hybrid-analysis.com/sample/f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bf81e07b-d483-48fc-9302-537833be94dd
Result
Threat name:
GuLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1251005
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Detected FormBook malware
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Steal Google chrome login data
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 884021 Sample: XZw2GNATrR.exe Startdate: 08/06/2023 Architecture: WINDOWS Score: 100 58 www.ugfc.monster 2->58 60 www.twinmall.xyz 2->60 62 22 other IPs or domains 2->62 80 Snort IDS alert for network traffic 2->80 82 Found malware configuration 2->82 84 Malicious sample detected (through community Yara rule) 2->84 86 10 other signatures 2->86 11 XZw2GNATrR.exe 2 24 2->11         started        signatures3 process4 file5 52 C:\Users\user\AppData\Local\...\System.dll, PE32 11->52 dropped 102 Tries to detect Any.run 11->102 15 XZw2GNATrR.exe 6 11->15         started        signatures6 process7 dnsIp8 70 107.172.148.217, 50085, 80 AS-COLOCROSSINGUS United States 15->70 72 Modifies the context of a thread in another process (thread injection) 15->72 74 Tries to detect Any.run 15->74 76 Maps a DLL or memory area into another process 15->76 78 2 other signatures 15->78 19 explorer.exe 8 8 15->19 injected signatures9 process10 dnsIp11 64 avxxxtube.com 67.22.44.7, 50090, 80 VIKINGHOSTNL Netherlands 19->64 66 www.nilhanzsa.net 64.98.135.11, 50097, 80 TUCOWS-3CA Canada 19->66 68 12 other IPs or domains 19->68 44 C:\Users\user\AppData\...\4hg4e2w8ftbp.exe, PE32 19->44 dropped 88 System process connects to network (likely due to code injection or exploit) 19->88 90 Benign windows process drops PE files 19->90 24 help.exe 1 18 19->24         started        28 4hg4e2w8ftbp.exe 18 19->28         started        file12 signatures13 process14 file15 46 C:\Users\user\AppData\...\9KMlogrv.ini, data 24->46 dropped 48 C:\Users\user\AppData\...\9KMlogri.ini, data 24->48 dropped 92 Detected FormBook malware 24->92 94 Tries to steal Mail credentials (via file / registry access) 24->94 96 Tries to harvest and steal browser information (history, passwords, etc) 24->96 100 4 other signatures 24->100 30 cmd.exe 2 24->30         started        34 firefox.exe 1 24->34         started        36 cmd.exe 1 24->36         started        50 C:\Users\user\AppData\Local\...\System.dll, PE32 28->50 dropped 98 Tries to detect Any.run 28->98 38 4hg4e2w8ftbp.exe 28->38         started        signatures16 process17 file18 54 C:\Users\user\AppData\Local\Temp\DB1, SQLite 30->54 dropped 104 Tries to harvest and steal browser information (history, passwords, etc) 30->104 40 conhost.exe 30->40         started        56 C:\Users\user\AppData\...\9KMlogrf.ini, data 34->56 dropped 42 conhost.exe 36->42         started        signatures19 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6uxtyzgh4vzjxeuzdhcet6iipcmyendq2ejtlro23f7yygooez4q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0ae741990942bc5b9a51a72dc1cc9f2197b8fe140b76eee9170c3260c00e8656
GuLoader
3682f76c6feec004f58d0b9c732b45215375d45f250bdac03fb3694097710c3f
GuLoader
4a7494bf219e9421f2aaf50f46b391b813b1df67aa4a929dfed977a4ae8875bb
GuLoader
4ad6c38be212777a181c374f391ebecdaed23e1a6449219005228c8a4f3a7ca8
GuLoader
4e57a7ae42e9005020df2671b6aa6cf19d044be264da5f8e1a4836d5a47b2f14
GuLoader
74c460852f392fbdd2ef8d83d9461371228d37fba88a6431fd205ee20bccf622
GuLoader
757ecedd9789cb6d77831f2e2c0fc312b05d9ad3e0f6d5c46e3d9c26ce325bc8
GuLoader
97afcb0a77ff4e18dea8e6c22f392e67271db8316b112f9086904d7b4ab065ca
GuLoader
bb9d11dceeb51aac57dda9cd059c4449daacbe2bc7cdee5b6cb5320b41c4ee21
GuLoader
ee06ec93a5853e2753e8c758fda076944b7cb7cc657fb249b03d28cbc45db077
GuLoader
+ 1'570 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:guloader campaign:xchu downloader rat spyware stealer trojan
Link:
https://tria.ge/reports/230608-hlxtqade8w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Loads dropped DLL
Formbook payload
Formbook
Guloader,Cloudeye
Unpacked files
SH256 hash:
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 hash:
fbe295e5a1acfbd0a6271898f885fe6a
SHA1 hash:
d6d205922e61635472efb13c2bb92c9ac6cb96da
Link:
https://www.unpac.me/results/fd337fdd-49ae-47c9-8e2a-e158f102734f/
SH256 hash:
f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679
MD5 hash:
e95742503cd258666b61c5dde8a9003a
SHA1 hash:
cee3b32cbbcec87c7393a066012e6a2479867d4f
Link:
https://www.unpac.me/results/fd337fdd-49ae-47c9-8e2a-e158f102734f/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f52f3c64c7e5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
GuLoader
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/396804/
  
URLhaus
https://urlhaus.abuse.ch/url/2655479/

Comments


Avatar
zbet commented on 2023-06-08 06:49:57 UTC

url : hxxp://107.172.148.217/23/cleanmgr.exe