MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb6a49d393c339750c2effe7797cf304d7d9bb8c95fdaa3431af177f7a677ba8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	fb6a49d393c339750c2effe7797cf304d7d9bb8c95fdaa3431af177f7a677ba8
SHA3-384 hash:	0c28604abb80965276731e0c59233d60e64951efdb6e02b99bec2f94717bdcec56aeed61a6977f11cb4a567fd352c758
SHA1 hash:	5596551c665df2154a64982f702ba2951411e29d
MD5 hash:	8a5266c0d2e45d8827823a4378ec1f20
humanhash:	blossom-six-south-east
File name:	C2-01 - TSC PO-20060482446.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	114'688 bytes
First seen:	2020-06-04 06:19:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9b02763e2af944c0a378eeab360e60a5 (1 x GuLoader)
ssdeep	1536:y42SPfxV40R7Su4+kgrKHxLdGKc+o0FDHdZ1gI80JG/9iSoxQVJEEX:3vPXR7SuxKVdhjFD9zZUnB
Threatray	1'543 similar samples on MalwareBazaar
TLSH	63B37C07EC888653D1544BBD3D278D7A3A2DB91C48015BDF71396EAFAE312922C9721E
Reporter	abuse_ch
Tags:	exe GuLoader Loki

abuse_ch

Malspam distributing GuLoader:

HELO: mail.goldsun.vn
Sending IP: 119.17.215.18
From: Dung, Nguyen Thi Phuong (DVK) [dung.ntp@tanphat.vn] <long.nguyenvan@goldsun.vn>
Subject: RE: Tan Phat Vietnam PO: Yêu cầu báo giá CCDC (TTĐT) - C2-03
Attachment: C2-03 - TANPHAT PO-20060482446.rar (contains "C2-01 - TSC PO-20060482446.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/group/harl_cyMbNbo109.bin

Loki C2:
http://egamcorps.ga/~zadmin/lmark/harley/mode.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/6488/

Gathering data

Threat name:

Win32.Trojan.Fareit

Status:

Malicious

First seen:

2020-06-04 05:46:06 UTC

AV detection:

28 of 48 (58.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7nvetu4tym4xkdbo77txs7htatl5to4msx62unbrv4lx66thpoua._file

Verdict:

malicious

Label(s):

guloader

GuLoader

4c085d783c734f76e23572661c1692d7b2e4ad30dab5f6c108669d4141f97c99

GuLoader

52f217cdebe83217297bedc352fac2e475e293e6cad52a1335b3641eeb8c412b

GuLoader

7a7760c4a4b1244950ea0fd475c53005ced18cb314a2e0fc4499086582e1a5aa

GuLoader

a3314185c4c7b813105231aa59fbf2045b1fa595fd4bf322370112926afc24a7

GuLoader

aee6f41ba3393811f2980cec1714785039dd6cfcc629b81479fc376f635868c7

GuLoader

d30f4ed99917a14353e7c981b527597931c9d7440e55173bb44dd6ac6317da95

GuLoader

ddf6f04276c1d976e62e199e6c928fb7a3d7aaec455a1859f8d8f605c89ffc64

GuLoader

e0d0b8ce88eb76ca3cb8339d7f49d2d198b2a51b43949b4ddd23a40889cafcc9

GuLoader

f505dd338ac82bc130bc50c89b509c371bb87e901842e64a12fd35749bf8b3b6

GuLoader

+ 1'533 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-jz46bclkje/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com