MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19e99ad36e248449944d9979c433f0277eac9e2b0911259e5c39d33bd194f399. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19e99ad36e248449944d9979c433f0277eac9e2b0911259e5c39d33bd194f399
SHA3-384 hash: 68ba9543b20acad19454af02fb7f63dc679a184cf24fabaf895ccfbb8f93c2c929dd2b0b5cfdd515ff877ca70c0cddf1
SHA1 hash: 581dcb053be41a0d9ca08043f5210793cf8699db
MD5 hash: ea6d1dd0fb82ce13f41d9b18b11241d1
humanhash: emma-bluebird-shade-ohio
File name:SecuriteInfo.com.MSIL.GenKryptik.ELBN.11686
Download: download sample
Signature GuLoader
Create hunting rule
File size:196'608 bytes
First seen:2020-05-24 19:36:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:5Mvmjle+hJQ3qeLzYV0iz48PBQ0s3jIupd5QpGvPbjo3KHhG9vK2w6naT11REBYZ:5Mvmjle+hJQ3kZz4PPfpd5QpGvPbk3oj
Threatray 414 similar samples on MalwareBazaar
TLSH 4014E04837BC672EDE3F8BF51DB1541483F1A4326A5AE34D8DC320CE461FB168A51AA3
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ELBN.11686.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 16:11:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
19 of 30 (63.33%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
azorult
Create hunting rule
guloader
Create hunting rule
Similar samples:
15145ed8e5ae3cf2acf9ad25bbcb3f782c4d8ba9674185d06baa66ae6d17f25a
GuLoader
151f57078e89aa2f81fcb307bf88fe23e9f2437a4df1e37def5d0b78797e12f8
GuLoader
2c80f61e5c61bb87be9e2d60e69093bcb5082fc690fcd751be787dbd118d5e57
GuLoader
6fa66f7851bea577cc6adfda11d3225a69b7c6554f028851eddd4d23ea074a59
GuLoader
7294bdc3333d08ac9c2397b3555c0126928c13600b23de09f21841cfee83f55a
GuLoader
7d02ae5ae3ed3b7a13ff5495174216ea3195764d7154b8e9b4997c74fd08fb09
GuLoader
862b45e2c98a175f625797db1d3342e0d9dc35b79e3386deb42c06b1918867d9
GuLoader
b30f264fda73db6970c313776095289e5fc0ee77f6be19010e2f9e125205e845
GuLoader
bcb474ac919440674135c673d8c6a0fc8015a63a15b2849c3346f74a716b5249
GuLoader
bda7bbc040614aea40e36657bd8f2b28145fa7572e2810455288ad21c95fae14
GuLoader
+ 404 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-x4gb6d3k1x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 19e99ad36e248449944d9979c433f0277eac9e2b0911259e5c39d33bd194f399

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367174/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/367552/

Comments