MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f93a630eab832224dee5372049c7e7cfab3fc0bd78d3eb9b13f9b384e4b0f81f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f93a630eab832224dee5372049c7e7cfab3fc0bd78d3eb9b13f9b384e4b0f81f
SHA3-384 hash: 3dc18c1d491ed7a038db2349e4a60190d4801a80c4e46572fa38a37a59a851157951c5721e457db5960c89d956a8ae52
SHA1 hash: 2c6073e62fec98fa547cb0e0edc5793b6a2bc746
MD5 hash: 80e07a7be306ad41e2f36115b365ec8a
humanhash: magnesium-mike-delta-jupiter
File name:ACCEPT OUR CUSTOMERS' ORDER (01092022-09092022.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:172'192 bytes
First seen:2022-10-04 06:06:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ea4df5d94204fc550be1874e1b77ea7 (242 x GuLoader, 30 x RemcosRAT, 17 x VIPKeylogger)
ssdeep 3072:ZAe+3aJpgWXTBuKfZ4c4Yj9N7OdoeURD3V0KE4+PnUrZ35wrtoC/9xTQOKDRx:uB+pgUr6cFN7OdRURx7EHPnUNp6t3iDH
TLSH T1FCF302193AE0E927D2B10FB02DB6A79A6F69F6222055631B6700EF0A3937781CD4D357
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter lowmal3
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-03T17:14:22Z
Valid to:2025-05-02T17:14:22Z
Serial number: 33cf3c68d96d4125
Thumbprint Algorithm:SHA256
Thumbprint: 5055e685451a0f15e2c6dbe93a42f91fe7e86a4da9c39ab2906ee738aecd184b
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
788
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.ML.PUA.13352.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a window
Creating a file
Delayed reading of the file
Searching for the window
Searching for the Windows task manager window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40991/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/633bcd8678d4acb349f49a92/reports/e4b20b71-b3c8-4e90-aefc-3207f299b149/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a4a2a381-7133-4039-82f0-ad94db74986c
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1082993
Signature
Drops executable to a common third party application directory
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for sample
Mass process execution to delay analysis
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 715550 Sample: ACCEPT OUR CUSTOMERS' ORDER... Startdate: 04/10/2022 Architecture: WINDOWS Score: 100 53 mail.majescoltd.in 2->53 63 Multi AV Scanner detection for submitted file 2->63 65 Yara detected GuLoader 2->65 67 Yara detected AgentTesla 2->67 69 5 other signatures 2->69 8 ACCEPT OUR CUSTOMERS' ORDER (01092022-09092022.exe 59 2->8         started        12 firefox.exe 2 2->12         started        14 firefox.exe 1 2->14         started        signatures3 process4 file5 47 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->47 dropped 49 C:\Users\user\AppData\Local\...\System.dll, PE32 8->49 dropped 71 Obfuscated command line found 8->71 73 Writes to foreign memory regions 8->73 75 Tries to detect Any.run 8->75 16 CasPol.exe 2 21 8->16         started        21 cmd.exe 8->21         started        23 cmd.exe 8->23         started        29 62 other processes 8->29 25 conhost.exe 12->25         started        27 conhost.exe 14->27         started        signatures6 process7 dnsIp8 51 151.106.19.112, 49800, 80 VELIANET-ASvelianetInternetdiensteGmbHDE Germany 16->51 45 C:\Users\user\AppData\Roaming\...\firefox.exe, PE32 16->45 dropped 55 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->55 57 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->57 59 Tries to steal Mail credentials (via file / registry access) 16->59 61 7 other signatures 16->61 31 conhost.exe 16->31         started        33 Conhost.exe 21->33         started        35 Conhost.exe 23->35         started        37 Conhost.exe 29->37         started        39 Conhost.exe 29->39         started        41 Conhost.exe 29->41         started        43 59 other processes 29->43 file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f93a630eab832224dee5372049c7e7cfab3fc0bd78d3eb9b13f9b384e4b0f81f/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-03 00:28:52 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
16 of 25 (64.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7e5ggdvlqmrcjxxfg4qetr7hz6vt7qf5pdj6xgyt7gzyjzfq7apq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221004-gva6msfahq/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2a0cfa10-a819-45b7-835d-b3d124ed1e44
Unpacked files
SH256 hash:
7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
MD5 hash:
c5b9fe538654a5a259cf64c2455c5426
SHA1 hash:
db45505fa041af025de53a0580758f3694b9444a
Link:
https://www.unpac.me/results/2bee27b2-7050-45be-ab7a-155d2ee7ae9c/
SH256 hash:
58097101ec525b95b212d80d587d928d135dbc7e827f69dccdf1f27f486ab522
MD5 hash:
9dda233a2d890e341be5ff5d82b5a90a
SHA1 hash:
69844747ae289399562f52415307a4332b6aef1c
Link:
https://www.unpac.me/results/2bee27b2-7050-45be-ab7a-155d2ee7ae9c/
SH256 hash:
8c6a95a1bf06c22224ab43bc1a1948f2cb0fd8d7089f2b828033c0fde161d2c2
MD5 hash:
d5bf01b2a316120d3d906e48e850520e
SHA1 hash:
a0e2f1caca1d35c227d231e6063d71ffe1d06322
Link:
https://www.unpac.me/results/2bee27b2-7050-45be-ab7a-155d2ee7ae9c/
SH256 hash:
f93a630eab832224dee5372049c7e7cfab3fc0bd78d3eb9b13f9b384e4b0f81f
MD5 hash:
80e07a7be306ad41e2f36115b365ec8a
SHA1 hash:
2c6073e62fec98fa547cb0e0edc5793b6a2bc746
Link:
https://www.unpac.me/results/2bee27b2-7050-45be-ab7a-155d2ee7ae9c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/f93a630eab832224dee5372049c7e7cfab3fc0bd78d3eb9b13f9b384e4b0f81f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe f93a630eab832224dee5372049c7e7cfab3fc0bd78d3eb9b13f9b384e4b0f81f

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments