MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dd4cc2127fa0f8b93d7f95ab3bc644d317ec7510de4d92d7a1daa8eaf54cdb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6dd4cc2127fa0f8b93d7f95ab3bc644d317ec7510de4d92d7a1daa8eaf54cdb6
SHA3-384 hash: d4bb88fc9b86e862ed55b78202904f468c8d006e3e3429bcff8857264159ef149f378bcdc69c82507ec2f7cfb6c4a6f1
SHA1 hash: 840fea4b17081f2a3966db70c32a3706846983d4
MD5 hash: 555a5e83f8dadc6445e95872265a97dd
humanhash: august-september-shade-seventeen
File name:FT_Swift.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'016 bytes
First seen:2020-05-01 05:50:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 343bf677bd95b65b8c7e66eb1d05de63 (2 x GuLoader)
ssdeep 768:a/DNObJ8Jg5vKDg8YmPe8LQsPyuLwzXwML:kp+825vGg8Xe+PyswT
Threatray 382 similar samples on MalwareBazaar
TLSH 25832A7AB6C8E336E24185FC2E29E2E84499BC7148028917FF84BB2F6D35D87E441357
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 02:37:58 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nxkmyijh7ihyxe6x7fnlhpdejuyx5r2rbxsnsll2dwvi5l2uzw3a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
035cca1ee500852ef7fda67e60c373ed2a57756c5fefa60ba7a05aae5b9021ab
GuLoader
4adf106d80dd2be5d8ea333dcc3a1d06770e4d913b25d05616247f9c66f99484
GuLoader
7ab96517f6852c124c82edf441496b2f005b11a4d1feb92f9cbfa2a2bffd1acb
GuLoader
b9e80d2e7af4a98e04149a178f065f16e08f1c8807d01a0c8e6fe694bc8bf53d
GuLoader
bb2faadcbc0d7c66a84bb763e34cc811194f21a2222541a62fd1c0d9d3ce6c42
GuLoader
bf995a7e9baf77fa301cd9af7adece6147bff5397246ade2643b9305395a5612
GuLoader
c5f668176f1cc10b8351eaf2813cf2b2c07f5233eb39b319ef99afbf4179dd33
GuLoader
c882cc422e4039600b31e53e369f05b29dc9dd38cab76facef8a42adc8d326b3
GuLoader
dea51f7f074a8d9b0e30626e11ca4a79de602da24ba64d0222ee1162a5fbb5ba
GuLoader
f2f28583a4690e1bc531879d34c4eeeeab62a88ec34e204b77428a640c0d00fa
GuLoader
+ 372 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments