MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3095c533634e0d3773040c4599e05afe14ebac6e81bad0801b6ec72f78df9c3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3095c533634e0d3773040c4599e05afe14ebac6e81bad0801b6ec72f78df9c3d
SHA3-384 hash: 1f29af8d181b3e493ecb1da331364616fa3409cc68d8f65e87453f14c814986b239cf1c2e8ce06c93abfd8490ac6d37c
SHA1 hash: c4f51920b509c79b14fffa37768a574feaab764d
MD5 hash: e4c5e6060fa5fe253512a6a665b1f32a
humanhash: fillet-twenty-green-nine
File name:Purchase Order.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:81'920 bytes
First seen:2020-05-04 11:54:34 UTC
Last seen:2020-05-04 12:45:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0f618f176da36e041458da8fbd45b62e (1 x GuLoader)
ssdeep 768:RznsddfuTI7FRSIXMqublunxD7mKxuXRv2DASPhY975S65cOzaLtV:RquTIvSInxD7mKFkSPhYPSgcO+ZV
Threatray 262 similar samples on MalwareBazaar
TLSH 7C83F6027EB4ED32E250B2B1DB66F6AFC3556C305831AD1765483B2E1F36A1A9D3025F
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.generic.ml.16175.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 12:16:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gck4km3djygto4yebrcztyc27ykoxldoqg5nbaa3n3ds66g7tq6q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1218e6f611d06cbf81e8b72e9c1fab06d8d54c5a7b6ce49e4e26bf86ec1807b2
GuLoader
14ef1e3ac43b65b915bf15b136502e42fbc03555377bddf1bd4cd71928d2f1a4
GuLoader
205034fed0edd3c5d8069c63783b3cfdeba86816e6f1f5f6899add096d482bff
GuLoader
250051d6d9bd369c1b513ab41b5f9da87b04166af831d170dcab225aa0d86913
GuLoader
7030c2032fc9a3b15dc8720636f25403873ca65156611b7ccaa2928d716874b3
GuLoader
7b743eec66064abd181281fa1c0d614f856ee083d23348a10c9612765342ee67
GuLoader
a7517b0fbbd35dc4990c2a61b792264a9cbbd77fc62f0673063df3c6a2d581fd
GuLoader
cb26b474b4f7be86dc5bf39c595a93d1e3353bd25312d83249dc4e1097df2f3e
GuLoader
d0a44650607ba722a1afaeda2b4cb8c56484a1c9e8bf72e51fe92a2e16d6dbcf
GuLoader
dabc62571ab7730cebaf8d46beb2765032674b43518f30fb228917570729add4
GuLoader
+ 252 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-eks76f983x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments