MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9028aeddf4c76b16753ea37720bae4088308671214e6cf192705622cf07d41e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9028aeddf4c76b16753ea37720bae4088308671214e6cf192705622cf07d41e5
SHA3-384 hash: 3944b56cd62f1f9d739787aded306881b489ea6d5b1b89bd0269b71316e2ad88f2f2431da42342cee3e1f46dc4cfeedd
SHA1 hash: f132e2e4fdd15f4b992fcc7028f9c27ea038c622
MD5 hash: 8f9cae83fc6609e2d5ba085bc273462f
humanhash: maryland-utah-ten-finch
File name:SecuriteInfo.com.Variant.Ursu.854797.23770.33
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2020-05-04 08:01:13 UTC
Last seen:2020-05-04 14:58:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5c1bbc5e1d231fb7e9ef47add13584e3 (1 x GuLoader)
ssdeep 1536:QH4rhRvtdcYO5dSlyRh40zdnq5r0m+WDn:QeRvd8dSlKh4CdqaPWDn
Threatray 68 similar samples on MalwareBazaar
TLSH E6A31952B7D1D60AFE6589F65B98C3A01066BC3A8C915D0739D0372E3933D49EA9333B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.854797.23770.33.UNOFFICIAL
Create hunting rule

Win.Malware.Generic-7751004-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 07:48:37 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0a6caea4ce7bf55029e1f01895a6c653fb2c5166f76dafcf94956dd8915e4eab
GuLoader
1001c873070cced8d9bb50e6f38cb0bdf9aa60eec13216df00297616a8c0acc0
GuLoader
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
2587f1479965f71d98a3f9ead9b9ae00fd71cb0efd00ce8843da9a8c443d0af9
GuLoader
39067a6a8ac06d60189b34afbb9acd73e8e33aba91653c39a037c2f78f972f29
GuLoader
443bc33e9d28fddd4229367cde23085b8d57549093ce8e991eb4753ce58c85fe
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
dda25996ab5b78fa63ab71aa304360374fe2eb6ded670c778b2c69d9fa1f1e40
GuLoader
ef8f03a25087eeab581d8439a0a19ba7148270d2210d479c1d6867fac69dc813
GuLoader
+ 58 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-yfq3r5dfms/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 9028aeddf4c76b16753ea37720bae4088308671214e6cf192705622cf07d41e5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/356745/
  
URLhaus
https://urlhaus.abuse.ch/url/356788/
  
URLhaus
https://urlhaus.abuse.ch/url/357030/
  
Delivery method
Distributed via web download

Comments