MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 126acb98fb11ef309998bc79532c29a142cc478d0fcd793c29eaf68f903d592b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 126acb98fb11ef309998bc79532c29a142cc478d0fcd793c29eaf68f903d592b
SHA3-384 hash: 9da1c0baf6a5a40ba2b805c568c67ad28abe4feabb5ae070fa25a134e3dc7295846ad89710baa3ed37ae7ba854ac0fc4
SHA1 hash: a11f52e3b13782f951ce9232e7c12d9d5eef8058
MD5 hash: 1e34d7f1c03237c6002f428ffffcb212
humanhash: california-diet-seventeen-ink
File name:PO_2020_5_118458_0_.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-05-26 13:18:08 UTC
Last seen:2020-05-26 14:21:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2efdb6e70c1f9c9413c842a27143b3bc (1 x GuLoader)
ssdeep 768:NUUXFEZPDxJewsniRVZBp/+J8Vxu0S4JFaZf2HL74C96/mxYsuXM7F2O4mk4:eUXmeviRVNE8VNS4aqDrxYsuXMB2OY4
Threatray 329 similar samples on MalwareBazaar
TLSH 43B3F803F7E8BC86ED028DB158C3AEA40E73BC606D715B077127B72D25762895FB1225
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/4960/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33901003.2358.29718.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 03:45:34 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
7eb79aa85e80bebf0a52217d26985acb5ff2f594e9f3e0b07e210d7963c2dd4b
GuLoader
86df8967bdd2d2f92df86193d138e2e4c15957e091644e2efef7687de49b6c02
GuLoader
92574e92ed7461639393ef09258609b637fc5e68341c5fe13e460f2dff705d0d
GuLoader
a4429d0165e0b0c5e3b7840303bed826a9de8122d824622656d9ae9d6e396eea
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
d07136d108ff4e1867ba77d46bd6f9e9f83e64566d83b1b7c2099dd0de7fc4a3
GuLoader
ee2b02132ab9b2a6489c7ef37c853d2419924a2ca16940297851012a33fdee08
GuLoader
ef8f03a25087eeab581d8439a0a19ba7148270d2210d479c1d6867fac69dc813
GuLoader
+ 319 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-pfmrwymxaj/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/4960/

Comments