MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13393c26e42a0d09bbd796f3f9b5109dc0d2e7ff7bd7f4aac0aa0c879c5c123c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13393c26e42a0d09bbd796f3f9b5109dc0d2e7ff7bd7f4aac0aa0c879c5c123c
SHA3-384 hash: 9dd1c3fffc4692dfc03104b4e6ee9daf0f25429156f7a52efcf72b6438f5965086d9b9bfe56346c44d9efe6c95f2f1e0
SHA1 hash: 26a84a8a9f862c0e71bf31c93e47152638adc6a2
MD5 hash: 8e5bcc743f8bf0a3389dbf33673b0d45
humanhash: wyoming-six-wisconsin-avocado
File name:2Xs5tVv
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-06-03 06:13:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4be877027d71b2fb68a4098a6dea92db (1 x GuLoader)
ssdeep 1536:ecFO8lLcbQI4HOk7WB8JlCLzwKQw1gzz/atL61GO:6Eok7WKlkzwPg0
Threatray 2'863 similar samples on MalwareBazaar
TLSH 959307037AD48505F1B24B702EBB86996F29BC2A5D439A4F354D1A4B7B30752AC6C33F
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6231/
Detection(s):
Win.Dropper.Vebzenpak-7995213-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 14:37:11 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cm4tyjxefigqto6xs3z7tniqtxanfz77ppl7jkwavigiphc4ci6a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
guloader
Create hunting rule
Similar samples:
122256cada458b72697ddcda3d76cb49671318a2e38e898f7f38aeb6f1a19cab
GuLoader
2215802f5deb432f07a1aeebb7eeeffdf18cc5a035b0315ea693b08a4dbf942d
GuLoader
5f8025bc323e672da091a43d6d7ddf8cc6d9e880ddefde5955d0cbafd0092c83
GuLoader
69e3e7a0726435f1d48dc9d56db3a3759fb038b9c8b7506ce48e5efc5460d839
GuLoader
7a3acd412036e1f071595f9ee144d45ee7dcc0a6f4fb8c6ed45022ec423e6061
GuLoader
85efd0b4c3bb6232c4e075e99c46574b564785b0bdfa1b8bd91805922d91cef3
GuLoader
893ef71a58da9c450161aa56fddb97cd0e9c377f94a55e1d71a42569ee085de3
GuLoader
b5f6c2a230e8c24dd4859e076e8802d5785c6af1056388a3bb660d091c1437ac
GuLoader
ecab33f5998dc995c200750f575b8571ae2a9d00b8264ed557be2d651230064e
GuLoader
fa4d6e0887210c5f967d3349942cd846130e5c3c227e56cb0782ec4bc0d9bea5
GuLoader
+ 2'853 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-d9336wdczn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

AgentTesla

Word file doc e232af703af0b3b3482f5b9db846d1ec384c66a44eaee37800efa34cebc2eb0b

GuLoader

Executable exe 13393c26e42a0d09bbd796f3f9b5109dc0d2e7ff7bd7f4aac0aa0c879c5c123c

(this sample)

  
Dropped by
MD5 1b7f56e8625f5eb3daf2f7491cdd9ef5
  
Dropped by
SHA256 e232af703af0b3b3482f5b9db846d1ec384c66a44eaee37800efa34cebc2eb0b
  
Dropped by
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 f44e0340051fbea54765193165ebed5e866a2110c5a87052642656a630cc4497
Cape
Cape
https://www.capesandbox.com/analysis/6231/

Comments