MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59825608710179356a6809648f78199bce58922841920895d441db2ab64e2da7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59825608710179356a6809648f78199bce58922841920895d441db2ab64e2da7
SHA3-384 hash: 5487e026dd385b63e241de6ff263f1ab7a03bb14a51b0078ee2dee2ea409ef6bac2624add7f12cd4dbbafc6cd05df962
SHA1 hash: 364ecf10a7570bb18981efe5912b98d7005930ef
MD5 hash: b6c9e47f697cf5c82fcd1c27d614f316
humanhash: river-bravo-illinois-black
File name:DISPE.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2020-05-21 07:26:26 UTC
Last seen:2020-05-21 08:52:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3c61d68ff40c054940d856fbbb39c888 (1 x GuLoader)
ssdeep 768:nqw6nlZB+xrKBwWFRj777mmVe3DlWuFMpfpunhCEdtusgI6BWvM0U:UlZBfwWFRP77mP3xWDVpCRtusUWvMH
Threatray 721 similar samples on MalwareBazaar
TLSH 6DA32A32F454FD70DE0089BE1D925FA8A55FBD300A42CE4B72C67B4E29FA681AD5034B
Reporter JoulK
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.FareitVB-AB.1587.5089.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 07:35:55 UTC
AV detection:
23 of 30 (76.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lgbfmcdraf4tk2tibfsi66aztphfreriigjarfouihnsvnsofwtq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1cd0666b758f28d4d3a402dc10f1b185f5a1fbbe7f74cfceea475e72a5bbecb0
GuLoader
50a5970afc0a5e55eb16da4d20a7f2ab4af3386d58751b276583aad18969ccac
GuLoader
b4c38303fd0ec6723132e2bc5017904720211a5e660d4e8a722707c7d4214586
GuLoader
b65a42512465c82d804bdb56b5e1e633afa4571a20dc68d311ecad4a8fc3654d
GuLoader
c21e141ac2bf8379284f20873d9a401fcde6ed367a200fdd7df782e67142ac24
GuLoader
c884dcf4fa00359eeb51ead67cd41d9a68b71f09e3588f03456244eddaa36fa0
GuLoader
d28f7e29c76ea32e8a690122a4d729408136d83a70ac491231b7458c740c86a5
GuLoader
d3aa9fd1ed4af3cc3a49e612b93a03f799ada340c1c086f7403448fe77115bb1
GuLoader
f02253cc15ef8590d38f2c623609c3d462c2352da4aab698b3959c8ba4ced4e7
GuLoader
f8a6d117bfaaeaf97082bdab997196ebc517e34c45eda9b687c19923feeefdd6
GuLoader
+ 711 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-delq1dcaza/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments