MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 473f59e503b660f8b9cd8f4a36f955f59cc9b0ee19dec2570d9a907c22df1907. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 473f59e503b660f8b9cd8f4a36f955f59cc9b0ee19dec2570d9a907c22df1907
SHA3-384 hash: aca0d21ce9aaa9f608257c9dbd6cf6afc3338cfb732253f68fd28bd081bdb13c6f154751f5fa8031efc800b26cb8f5be
SHA1 hash: c1415064442248a7656c5a559d626c5d056d9e70
MD5 hash: 052bb31bfcf0d9b4df3013f5175342b0
humanhash: utah-thirteen-happy-neptune
File name:Misprizalb.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2020-05-04 04:49:11 UTC
Last seen:2020-05-04 13:55:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2d641e3afa0690e071b05cb45cd8fe9f (1 x GuLoader)
ssdeep 768:Jqc3e7VMFKrF+/v3UYQdkXaXjjamdkgdda7SdBFtqC0AAn2uWVK3fKYfu9V0dIly:s7KF5/vEZHB3qOK2fCb5My
Threatray 184 similar samples on MalwareBazaar
TLSH A9A3C752B7D4920BF62556B21BA8D6E44062FD39AC511A073EC4772F3E32E05FA5233B
Reporter cocaman
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.38732.21162.10597.UNOFFICIAL
Create hunting rule

Win.Malware.Generic-7751004-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dynamer
Create hunting rule
Status:
Malicious
First seen:
2020-05-03 23:09:36 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i47vtzidwzqproonr5fdn6kv6womtmhodhpmevyntkihyiw7dedq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0e2ff65bf3e2ccdf8a5c94830b0c8b72ce136d017f47bc14933ade45b9bbaeea
GuLoader
10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821
GuLoader
14bd280177ece118d671795a8b372a0d7de0f3ad3b842ed35726d9b587cb1608
GuLoader
40950dcb88e56bcea0e542f297d60fe5a96d410473ec3fe51e9234b40304d329
GuLoader
61bc9714c9d544e67950671f9bf407264caa04db3b82db8deb5ee40e73921e76
GuLoader
7051cafeb459d49b51e160e4dab61b346325159efeec3c734a7131d8e96c3c14
GuLoader
9028aeddf4c76b16753ea37720bae4088308671214e6cf192705622cf07d41e5
GuLoader
9059531fbff89a14fc3761330cac92437bee44349e6b62e7e807422b4c57e2fe
GuLoader
eaf38de6ac4347ac84bcbe648301fedfe021aeafbc3bf40404a4003117a8967a
GuLoader
f573cf3eed6dc5635fd82f657a0912c151e2762188e71d161bf173bd40abaa3d
GuLoader
+ 174 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ww9vhtvt96/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

7z a5785a5c457cbb9ea804860f360d79b46c6f5bafa472229b7e1fdef13433161a

GuLoader

Executable exe 473f59e503b660f8b9cd8f4a36f955f59cc9b0ee19dec2570d9a907c22df1907

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 a5785a5c457cbb9ea804860f360d79b46c6f5bafa472229b7e1fdef13433161a

Comments