MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03b8ed717d92754a5002afcf6aff7e42e45330465bf2706bf6d8a53ba6f7250a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	03b8ed717d92754a5002afcf6aff7e42e45330465bf2706bf6d8a53ba6f7250a
SHA3-384 hash:	4f665f7286cb7ef0496de76ae160fad1dc37f4d823bedbfd8ffb19f619115cab6936a335e220a11c060ed29c1d368be5
SHA1 hash:	8ecd8836fe31083dde58775e864e8de0d8f45ce0
MD5 hash:	c1c5fed30fbd3d115e22dbfaabc97cb2
humanhash:	winter-nine-kitten-solar
File name:	DHL Shipment Doc.scr
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	114'688 bytes
First seen:	2020-05-27 09:19:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ebb216f2811a575b1dcd3c5e617dc8bb (1 x GuLoader)
ssdeep	1536:2Y48LAUSW89y3+A4/SFFNRpo3ViLcwOdIgD4J:2X0AUrwOJ4/I/pobig8J
Threatray	343 similar samples on MalwareBazaar
TLSH	01B3091771D19C72DC3D9FB2497199A50D3BBC3529004F2B7348BB4F693A2DE6AA031A
Reporter	jarumlus
Tags:	GuLoader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/5692/

Gathering data

Threat name:

Win32.Trojan.Fareit

Status:

Malicious

First seen:

2020-05-27 09:35:57 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 30 (66.67%)

Threat level:

5/5

Verdict:

malicious

Label(s):

guloader

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-lbgmfk34cn/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of NtSetInformationThreadHideFromDebugger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.