MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31c29b9b1cee6db4cf305b1e74026561898466f13531fea132a8d4978db9e843. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31c29b9b1cee6db4cf305b1e74026561898466f13531fea132a8d4978db9e843
SHA3-384 hash: a43bbcb101ec19c3db996b2680823de4bf846e2ae1fdce0eb04ecce8794c706f708d6b2c3338537d7f0306a5e25cacb8
SHA1 hash: 0c0de0e90fd0b020aa93221f1f4e7b6e19c95005
MD5 hash: e72681c214857f944766b78af040231e
humanhash: table-six-september-fish
File name:SecuriteInfo.com.Trojan.Siggen9.46173.20266.23285
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-14 09:37:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1415836dd4c96654349595d774fd7f28 (1 x GuLoader)
ssdeep 1536:EkuXjGq3HKyh+fuCfMppB6LhE/soverU:EhXj7H1Y1yB6LhKveA
Threatray 635 similar samples on MalwareBazaar
TLSH 6B931817F1E0DC62D6644EB21E52A394299BEC305C208D476DC53B3D3A3AA27EBD135B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.46173.20266.23285.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 00:52:18 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
08361399bcfd6c87b301f7dd61be86d5eedf3013608d3cd98c818435bd43a724
GuLoader
10e06d6dedcfa52bb09cfb066ed4b5276a6a60ccfc5a6230911ce04b829f381f
GuLoader
50a5970afc0a5e55eb16da4d20a7f2ab4af3386d58751b276583aad18969ccac
GuLoader
9eb3b45e80a9c2a6961a24c2955cf11fb51fac3416cb1eaa8e5f26164c00d39f
GuLoader
b289e7a3e27dfee54ea6a2610a3cc690b96d7dafec31756401349935e3d83202
GuLoader
b894523c9beb2e22e87d705de2f9f48a907f82a2cd9c55c3dc0c1ca186fcef20
GuLoader
c4b5846ab10b6ac87f6f176bcb8a3f76a720628fd8b1aa9d7c1f603192f67bd0
GuLoader
da40229062dc045460d3adcd70e42d15378ec4a83fd93738b30a59f5fab8da10
GuLoader
dcf5521ac420d05a5ad5590673c275b37a4720496c08fa225fa695141a809867
GuLoader
e943534d22e73e0d062b7917c007b744ce19014e0a0c90dfd37219281bcf204b
GuLoader
+ 625 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-8xc839yksx/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 31c29b9b1cee6db4cf305b1e74026561898466f13531fea132a8d4978db9e843

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/362552/
  
Delivery method
Distributed via web download

Comments