MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 845f37af5c185070659d6a1567091c612a7f4363bbf0e93192f099967d6d8cc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 845f37af5c185070659d6a1567091c612a7f4363bbf0e93192f099967d6d8cc2
SHA3-384 hash: 232a06ea8ba94be6a9677eba073ab545e34d2e5a1a1cf1ceea4ec4ff226d496674ddf726bb44fbc512a6cc8096bf8406
SHA1 hash: b4d9458108e5cb246c58ac02e16bb22f458add36
MD5 hash: 3ad9e2b68c563b1d127d24a6db5349e2
humanhash: coffee-mountain-undress-diet
File name:845f37af5c185070659d6a1567091c612a7f4363bbf0e93192f099967d6d8cc2
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-06-03 09:04:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1cc5e4409f9ce2ba12b08f9a89c6a2f8 (8 x GuLoader)
ssdeep 1536:BSPfxV40hTqw59kgrKHxLdGKc+o0FDHdZ1gIMdBJcA2nLxGOKUFTpH:UPX5qw5lKVdhjFD9zMt+hFTp
Threatray 5'088 similar samples on MalwareBazaar
TLSH C7B38C17ED4C8553C1584BBD2D134E797B0DA80E0D006BEF75756EDBAE3120A2CAB20E
Reporter raashidbhatt
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/6236/
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 10:34:18 UTC
AV detection:
21 of 30 (70.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qrptpl24dbihazm5nikwoci4mevh6q3dxpyosmms6cmzm7lnrtba._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
043ba161ac2f0d30c5a15799d3ce26ec63989d278f58867aeff64ce7ecb41f42
GuLoader
27faaaca4acb955010d7b8c16764a536c04149f2d332f99668d6ff6f292bfc20
GuLoader
5628310c6fe718d77dadbc5c8cb6238faa27942517b590c2a87c07aadca429d6
GuLoader
5c70123d1edab1b0a21e7739eb78134aa2dcac1edf08fab8a365463b4d1070d8
GuLoader
639c28cc97accffb8a92a13ad5056da2a739421ef4965e768fa57356a6685d19
GuLoader
895e7e85e398a6bd3615a8453c1ed21979a2676fa84af0e53077635f812b64fc
GuLoader
991289640d200976fd319f76f9acbbf7f3e304b24b5117cb8da23bcf091b2a06
GuLoader
ce860f3976ba5df3c4465a4b60d12980677dccc961a9fa91555c7b9de14c3dd8
GuLoader
ceec91127018aba0be51981277015baf08e3f0ef6fbd0a5efe5821fa698ba645
GuLoader
f708f99bcb86bc017f5b34435a241cb77fa4bc4c37d47b85f1ecc43e9ddc365c
GuLoader
+ 5'078 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-nyh4hq1k7x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/6236/

Comments