MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1218e6f611d06cbf81e8b72e9c1fab06d8d54c5a7b6ce49e4e26bf86ec1807b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1218e6f611d06cbf81e8b72e9c1fab06d8d54c5a7b6ce49e4e26bf86ec1807b2
SHA3-384 hash: 200383669fceef38c897279559f3a9c9c3b9a8793c451888febffeced53f6e9c77084c66536f90efd6c20260292df02c
SHA1 hash: ce54c62827155a514f40c954791661eb6cfb8317
MD5 hash: 1ece7e2d16dd0c3295cd48e50c41d0df
humanhash: arizona-thirteen-lamp-bacon
File name:Purchase Order.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:81'920 bytes
First seen:2020-05-04 14:58:33 UTC
Last seen:2020-05-04 15:43:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f802e97b1162aadd82abe06e7a05577 (1 x GuLoader)
ssdeep 1536:1vhUeuyPRNP1zt4my2Nyaf4+vLUdX9UXicB:Dd7HkMpyX9GiI
Threatray 367 similar samples on MalwareBazaar
TLSH A883D511BEB8EC72D01475B2CF59F2AFD365AC302831894B24483A6E5F35A269E7435F
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.ELTM.27012.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 15:35:25 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 30 (76.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cimon5qr2bwl7apiw4xjyh5la3mnktc2pnwojhsoe27yn3aya6za._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
14ef1e3ac43b65b915bf15b136502e42fbc03555377bddf1bd4cd71928d2f1a4
GuLoader
250051d6d9bd369c1b513ab41b5f9da87b04166af831d170dcab225aa0d86913
GuLoader
3095c533634e0d3773040c4599e05afe14ebac6e81bad0801b6ec72f78df9c3d
GuLoader
623d2dced40110b216c19c5d48ecb250235278055ca3a7192ac98a8640d663f2
GuLoader
6dd4cc2127fa0f8b93d7f95ab3bc644d317ec7510de4d92d7a1daa8eaf54cdb6
GuLoader
7030c2032fc9a3b15dc8720636f25403873ca65156611b7ccaa2928d716874b3
GuLoader
77aa8e597d8c1b23af6c98a85e717edde17106fdb806ceadc6cedef510b9e7c8
GuLoader
7b743eec66064abd181281fa1c0d614f856ee083d23348a10c9612765342ee67
GuLoader
9b77dffb83a26f126a334f4dd9de9c8a21802a1b05de3067584ebfa25826f9fa
GuLoader
d0a44650607ba722a1afaeda2b4cb8c56484a1c9e8bf72e51fe92a2e16d6dbcf
GuLoader
+ 357 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-7vr89y2t2x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments