MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6528c7c514e9309db9ae4cc57daadef585d47fd338e0084d1f297cab2b95b633. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6528c7c514e9309db9ae4cc57daadef585d47fd338e0084d1f297cab2b95b633
SHA3-384 hash: f3ea7e0505ce9e9cf371b529dd6cc1123f8b13db14bf87c4bec86a5808ebe1ff069b38b8f9026b748fac2c54c8494f48
SHA1 hash: 9564ecf7b2bf4aae142f90135fce9f6b06b19a85
MD5 hash: 6aa88e7fb4926a20ebed56da13ab1f53
humanhash: carbon-illinois-hydrogen-ten
File name:shipping docusments.bat
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-22 14:34:02 UTC
Last seen:2020-05-22 15:48:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e962f8212a952da5e058314d60017983 (2 x GuLoader)
ssdeep 768:BwvgMB9Qt8NOP6fXNws/McMcGw8kuFect11lkDWtJZAMB1L8z3DjQ:Wfst8Ntus/McMcGvkuFeWaMfUHQ
Threatray 650 similar samples on MalwareBazaar
TLSH 46930831B558DC62CD280FF19A76CAE41126FD713CC04A4B79DA7B2E2A3254D98727C7
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 14:35:55 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
00561595f71768d7555b2a39fc0fd39819640b8b08af4302ba03bf8b3dffa8b2
GuLoader
2ea5a4fb25528051254f255dc64913ca7d4faa1ecba2f40a55b536f871624fb9
GuLoader
4c7955fd946f9b823079ac10f83004c396d5b9877703b5ac2a073a52d8fcd376
GuLoader
4fbe77777093608a25b248db192e96bb062da46835e2739c07922c39cfbb0d57
GuLoader
5c883c457a3dc0ddd6ae66380087c57fb714bdf90ff79185ae0cac329677fe26
GuLoader
736cb1644adf35fc139e7031d9bc5073816784d21b34de83260387f47f13ba43
GuLoader
77985fca7ae6b60c8025ba326e3bd1d9949c3fb32b9ca0f99f040be633823a7c
GuLoader
bbcb85929cfc7f9761b8bbbd06f473b2ad14b885e1cc2874c2f94d14af2b0b6a
GuLoader
d0c571182eb67023db9b2f8c440dfc76488b23ea51819de40bbeca16fbb9322e
GuLoader
dc186623afc0375b9ebd176481a9f37268351cac07f2825b8221124ec7ac9edc
GuLoader
+ 640 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-3dmrp9ae72/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip c4db6cb6af803f273eb060a62892bfd6203d567c49fb80d2e8c5e3e58055a660

GuLoader

Executable exe 6528c7c514e9309db9ae4cc57daadef585d47fd338e0084d1f297cab2b95b633

(this sample)

  
Dropped by
MD5 2a04bf0604f56256bcecaeab2350225d
  
Dropped by
SHA256 c4db6cb6af803f273eb060a62892bfd6203d567c49fb80d2e8c5e3e58055a660
  
Delivery method
Distributed via e-mail attachment

Comments