MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 581a5839e84c512e1ba78931b78cad6a25ad5ec0c6033d033db3350889285c9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 581a5839e84c512e1ba78931b78cad6a25ad5ec0c6033d033db3350889285c9f
SHA3-384 hash: b8134b9c177ace3d83976ce1c3ea818fae6d4de671ff5faba4c45f1a25f3b6fe2869e4f568ef0c99913ccb6313166697
SHA1 hash: bed44d161c3b576ee5e5588b5c91cc41ee2b364f
MD5 hash: dad1d3d7cf55ac926581c4b0f359a862
humanhash: wisconsin-wisconsin-victor-speaker
File name:SecuriteInfo.com.Trojan.DownLoader33.39270.16792.6283
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-08 16:10:02 UTC
Last seen:2020-05-08 18:01:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e0e62eff881bd3791fe3b022b4beacbf (2 x GuLoader)
ssdeep 1536:+r8vX9tBWJ10WWBVP29B/bvXZ3btJ32/Q:sitB0C29BF
Threatray 617 similar samples on MalwareBazaar
TLSH 6093F6156DB4ED21D625B9F2EB26F6DED306BC301831481720C63A6E2F36A129D3635F
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
5
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.39270.16792.6283.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 00:16:36 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1f3c0cb514e5c47627a6f0947deec29e824dfb0d13121021ea6115d3f09db9ee
GuLoader
1f970a14fb1efcbcdca7c274d76c4eabd3699e62015a58226d6e328b83d4f0fe
GuLoader
3fe9eed0a3a27ff6cc16b6999d5b040cb7c103a4cd59262ffd21744537e7c8db
GuLoader
430503a02927d70df40c2f5649ca255e98017a15af6796633c27d2c0d3f3314c
GuLoader
6f3800e20217ce801b5c4106be5fb1160e4accfd565e371b670c52605f2600b8
GuLoader
7fda87ee7ea129f8263c57c5f9d4ed2db3221a067ad0d3dee0a1918d4be96b94
GuLoader
9826cc38078ee6a4a6ac24f17da67a7848eba1c75250875aac17bd1496b2bb4a
GuLoader
a2854003ec6cd974aacccacca9e7d12208e1e70dc2c3d722c238bafb3aa3ee26
GuLoader
b3f47169101e8ad239ae4a647447bef75e9ec88d5fc096299880756868514ed0
GuLoader
bd6f8c6b0d3ba7d364667c32994f536d69d93aee58e46ef1e9899452830c001f
GuLoader
+ 607 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-vdkqqz9lsa/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 581a5839e84c512e1ba78931b78cad6a25ad5ec0c6033d033db3350889285c9f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/360024/
  
Delivery method
Distributed via web download

Comments