MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc38656ef9f0487f431fc7e32fd39213ebeefc9ca0728fe04d160cce657d5af4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc38656ef9f0487f431fc7e32fd39213ebeefc9ca0728fe04d160cce657d5af4
SHA3-384 hash: eb14d3a7fd1704006bd44ea45512257fdb3fbdc8aff0625fa5c3222cc856ff5b3f14c0d3b4e6903007b388fbc1faceff
SHA1 hash: 7bd610b9d392fd7c988e2daa6f0728ef0b5b06ac
MD5 hash: 5b2b78379d23948045d051729df87c9a
humanhash: washington-angel-table-dakota
File name:5B2B78379D23948045D051729DF87C9A
Download: download sample
Signature GuLoader
Create hunting rule
File size:562'069 bytes
First seen:2023-09-12 01:00:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f0c714c36e6cc016b3a1f4bc86559e4 (199 x GuLoader, 14 x Formbook, 4 x AgentTesla)
ssdeep 6144:9NW/WhV9xu0IEmKom+CohRy7dxaLf81U4A0p0FfXpwTFKoaq5chMHU9xUdd5JOi4:vqCk0InZhUdxab8bMfngkMtXsvzh
Threatray 2'569 similar samples on MalwareBazaar
TLSH T108C401827738D8B1E19EC630517516DCD63AADBB481F3307FA007B69A4B79C1BA2650F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon a434a4845e2ec098 (1 x GuLoader)
Reporter Anonymous
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
349
Origin country :
KR KR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5B2B78379D23948045D051729DF87C9A
Verdict:
Suspicious activity
Analysis date:
2023-09-12 01:03:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3322d946-c310-4b48-b799-352f7584d6fe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448029/
Detection(s):
Win.Trojan.Tedy-9956118-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% subdirectories
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/64ffb84f25e2ece4df6a8130/reports/624df08c-2d9b-460d-9b06-e3cf33d6f3c5/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/fc38656ef9f0487f431fc7e32fd39213ebeefc9ca0728fe04d160cce657d5af4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9d8be5e8-23af-42a2-90cc-84f2e32fbcec
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1307604
Signature
Antivirus detection for URL or domain
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc38656ef9f0487f431fc7e32fd39213ebeefc9ca0728fe04d160cce657d5af4/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-09-12 01:01:05 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7q4gk3xz6beh6qy7y7rs7u4scpv657e4ubzi7ycncygm4zl5ll2a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
cloudeye
Create hunting rule
Similar samples:
456f09b71ed09cbc590f6a3b8d5aacc7f0fb94521d8b19b80d2a201e5f73b5a0
GuLoader
4a30f84c5fc555603a11244bf58e1a01bacfc09047068f942d48d674a1375c6d
GuLoader
55eebc888e9151e28295587ff7c12c40f8b7ae5f23d29bac79c6444277940a6a
GuLoader
67334009d5d6fb492333a8d6a850b2c464654aaaf96ddeef125129af29ea3d66
GuLoader
846ae70abd97cfc15d14a0261e9c6c38643e071dddf73fafe3bc3e5d3769511b
GuLoader
b2823172397c389e1ff948bd03473193ed8527eb19edff06cbb16e2b43ebc19f
GuLoader
b2d5e15268cb130c995118e17afa1198ca19604a20b91f1907a7ef18210db30f
GuLoader
bad6dc695ec91155fbf548d43e3039c1b694db28c1a713b81ecc2d59674635cb
GuLoader
+ 2'559 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader
Link:
https://tria.ge/reports/230912-bc75rscc8z/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Loads dropped DLL
Guloader,Cloudeye
Unpacked files
SH256 hash:
c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 hash:
792b6f86e296d3904285b2bf67ccd7e0
SHA1 hash:
966b16f84697552747e0ddd19a4ba8ab5083af31
Link:
https://www.unpac.me/results/55d02d88-2027-4678-b6a8-ecaaea30e2ab/
SH256 hash:
fc38656ef9f0487f431fc7e32fd39213ebeefc9ca0728fe04d160cce657d5af4
MD5 hash:
5b2b78379d23948045d051729df87c9a
SHA1 hash:
7bd610b9d392fd7c988e2daa6f0728ef0b5b06ac
Link:
https://www.unpac.me/results/55d02d88-2027-4678-b6a8-ecaaea30e2ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc38656ef9f0487f431fc7e32fd39213ebeefc9ca0728fe04d160cce657d5af4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/448029/

Comments