MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 691f116a33f2fc98e59cd019c856b9cdb6202de6b09091481b980ef60fecaef8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 691f116a33f2fc98e59cd019c856b9cdb6202de6b09091481b980ef60fecaef8
SHA3-384 hash: 90ce5025fcd8fbb1052ac6bd9ad2a27069dfff29b1c0e869d739a1fd21e88e2cc131bdb65ce2ad00b8ddbabd8f847900
SHA1 hash: 576ccbfd515e99858204a7f380c83a0c292ab1d5
MD5 hash: c67dad6f21ef7e58550c385973fa55bb
humanhash: oscar-harry-one-solar
File name:temp.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:192'512 bytes
First seen:2020-05-19 21:40:55 UTC
Last seen:2020-05-19 22:37:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0fef289f5288e8aaf26eef5390a58876 (1 x GuLoader)
ssdeep 3072:fAwYFXvTKRoQG1yMq3cO55WwJQU/UHJf1zQJFa/:YwYcigs45bxsHJf1zm
Threatray 698 similar samples on MalwareBazaar
TLSH AC144915E691B42BDEF94EFE5BE29AB5A0D92CBA9500D70379043F2F35F9885E024133
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47252.17280.15383.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 13:08:24 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=neprc2rt6l6jrzm42am4qvvzzw3calpgwcijcsa3tahpmd7mv34a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
15c365dfb62dc041e46ede5ae90f2e0966d1000b5936f0ed5d68f5d10e813171
GuLoader
4da0526019c843ade96399a33f2a5e9a9d8e415d69859ee8c7874439956c131c
GuLoader
859cc79621eca1e9b1bc85a569d0ddfcdf83440090e8e4ed7aa8054e2c9c460a
GuLoader
b267c228b488319e3514de6a929f16f55e18cf8ac9924f2989b199ebe6b51a59
GuLoader
c37ae1ed1bf166c96faa73db4544f415c2b81f0a42ccd5311e0aabc0b9e4f455
GuLoader
c3b88b1d9c86a4f7cb1ae7c8b91d44d67c9c9e66ea51504c3204eb575a668fea
GuLoader
d2669f09cb9d457a0bb1ebc7db59cc0f53778ebf2fbd90f84b7c3fd587a109bb
GuLoader
dd7268284b041dafef56b6a8a4b565b3a0c54e1eaacc68121a1688e03798e72d
GuLoader
f02253cc15ef8590d38f2c623609c3d462c2352da4aab698b3959c8ba4ced4e7
GuLoader
fff7d8c78dd6f34509bde90ea015593f8e2fce0b0022899f96982f0772c6b9b2
GuLoader
+ 688 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-xrk4wqbxa2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments