MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 327a0fccc9299609a7553d5a29b26753cfe7e84cb2bcd1dd8625a5d72241a8ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 327a0fccc9299609a7553d5a29b26753cfe7e84cb2bcd1dd8625a5d72241a8ba
SHA3-384 hash: bfcaf53b6a116e00eb2cf296bf5c665f1f319346e5e5f6181c5664975ba40061761782143798594ae73dc6d3eca3e23f
SHA1 hash: d234f428de42b53cbd0d016db5b8c8f23f9eca44
MD5 hash: a52d23c9195f7060d277d0995a86ca7e
humanhash: white-edward-missouri-nuts
File name:PO4501640272.docx.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:192'512 bytes
First seen:2020-05-19 14:00:56 UTC
Last seen:2020-05-19 14:54:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 58c515175d16b6f6d8f80c6cb65d70c1 (1 x GuLoader)
ssdeep 1536:JdAE4tIoCOFHieukdV8v90iyDOJ8lVZQwtq8BtwqOz9Rg9mGRhSTHb89kG91tFwE:JdA/VSqWaLC8lVHWqO0d6jcDP
Threatray 99 similar samples on MalwareBazaar
TLSH 4A145B05E694B46BCDF58EFE47E69ABA60C81CF9A905D703B5043F3F75F4884A124A32
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/4387/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33864640.31606.9958.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 03:42:38 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gj5a7tgjfglatj2vhvnctmthkph6p2cmwk6ndxmgews5oisbvc5a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
08b47c6d183afb72f383ced4639ba73a03d9b36f06617585b3a3d28b69d1ce9f
GuLoader
11892c93ce6ecc668a92bcbb2e618edbc40f87cea8938e2dbe7061cbc6d1f689
GuLoader
4f86175e5500be87cc95ea9fcaf565970e15a86b2aa3223f8ef8d25e72cec376
GuLoader
77ee7b0a10f3c0ab08c1b1f88ceb0dd979e9c2fee17ac5fd14c9ce27002f6078
GuLoader
7c58672f646a85dd65ae2c5d44fdcfb899584a9a27650418a06ecc495cdf7a86
GuLoader
85e0ff2f0c03b8d8ce1d32b446dcef0e32b79fa581a9c27dcf4d0bb92c6b167f
GuLoader
ad3bb3f26289dc46ab58afb6cdf67ca9a256519fd9d087a418f849f9bcb78c25
GuLoader
c5c5e59bb18bad1427714d0007b676e658d8e08faf5a0632ed88912f5816d525
GuLoader
e5d4600354cad7a882caac33f0e18bc6702a269dab9315ef71835fbbad747626
GuLoader
fc6e4e6dae2a913cbaf3d495ab6508f01660f1cd6a1b20a84105776c8f65a090
GuLoader
+ 89 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-yvhpwnxvyx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/4387/

Comments