MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dca577dc2b23589fe09acb113d778de0f363b4ef58be7c862745d8514850a7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6dca577dc2b23589fe09acb113d778de0f363b4ef58be7c862745d8514850a7e
SHA3-384 hash: 61cb493036ff8dc3871bbf12f99f3afc5a17ca9ace1369cb6b94887fb653a7d6fdfd22ceb8105bea9effbac234c26955
SHA1 hash: d8d6dc4fdce11d63195ae9a3aa6fe3e6a36c2db7
MD5 hash: 4a05f10a5cd56467c95cc727b6fc2fd9
humanhash: failed-mexico-butter-comet
File name:baller.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:151'552 bytes
First seen:2020-05-20 04:38:21 UTC
Last seen:2020-05-20 05:35:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5aad3710eb94514bc3d40de3c166ccb1 (1 x GuLoader)
ssdeep 1536:DGMlyU1cI9TzlrsUPrGGDuPzn7ubIBJpm645uv/hkdgd6Xr3jlm4TKted9u:6MlyUKIvTNiznMIB6uv5kd3TbTKt49u
Threatray 216 similar samples on MalwareBazaar
TLSH 6BE35A65F1C9B806D121997DCE66C6B9652B3CA84A11C80B34C23F2F79F3906EA3531F
Reporter JoulK
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33864608.4613.13289.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 10:11:54 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nxffo7ocwi2yt7qjvsyrhv3y3yhtmo2o6wf6psdcoroykfefbj7a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0785384b7bf97e6d74ac22ce8a6ba6cd629d858dd778928f6a4eac974c35cf61
GuLoader
2467434b0ac840b5f4dfa8ac3bc14ac9ee6004e7b71bfd3303ab62b6345f0c62
GuLoader
25fdf9f56f06a54483b8280c76f2402526f29394e367af1a8c99cd80801a9527
GuLoader
4193084a6eba68bbb6aef41ffc1f21685208c6b942de9e5853b70b04834c296e
GuLoader
63b7d1315ae6db5a6f0c66fd1e8ade94a83a9bda0eb3864734e511c087430d7c
GuLoader
824f3b6b2f801742c68deb29ccf2347f591c5d04262dc1ad9efcb756be99ea25
GuLoader
d0bf046a77dccc79cfd0f254f43684e6b7475c69baeb7412c0a55cb54c8023e8
GuLoader
e3b22f7b9f72b19b41dfe024803aeeaa88d0072a3e10a5bea82413285721c91b
GuLoader
e9ca08e9192adcb0c65eae06bbc2ba1439b2615aeefee53a7cb26f15d691c071
GuLoader
f01984aa9f7805e8261655cfad5f92a5e06e48170d6a9fb41e5a2c22bfedec6d
GuLoader
+ 206 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-62dvjcsk1a/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments