MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95aa3a7cc02051435206105a14e7e78e76bcc633dc1731383f13ddfac7d7926c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95aa3a7cc02051435206105a14e7e78e76bcc633dc1731383f13ddfac7d7926c
SHA3-384 hash: dfda4294b91270abf99205e2898899fc2c5c8c21a1096b6bd44ed14f6fcfbb1c8df212f8039bd9ea723d14950614b75f
SHA1 hash: 3e74c475c9946506751ec321ee4dcf931a9af7dd
MD5 hash: b8b8f7aecec968e47c056fc9ba881981
humanhash: minnesota-mars-yellow-uncle
File name:Order 20200519.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2020-05-20 04:50:10 UTC
Last seen:2020-05-20 05:35:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8f8118597c4e4ef34c3654287c5213e4 (1 x GuLoader)
ssdeep 1536:oMVFyjnT33dbf/kEaAuX2TYGVZpjD6ZZ5V2o9Qj9:TVFI33db5Pmde
Threatray 159 similar samples on MalwareBazaar
TLSH B0A30862F6D0E862CA14CAFD5D7585AC074FBCB54912CA0B60C93B1D1AFBB82D931367
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47375.27810.13976.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 02:36:29 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=swvdu7gaebiuguqgcbnbjz7hrz3lzrrt3qltcob7cpo7vr6xsjwa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0844334598a3afd4d6c303956a1e56247c59e369b837b71ff31a55d1b404a4bc
GuLoader
09838078bc786269db65986e324234d647ff0154b07565e59bdf34f5f72d650d
GuLoader
5f845094f591cc548f669c31a1cbd8466bfe37bdd890d12e535afd73242d58a7
GuLoader
8e01834fb94698ea94b41965f1847d283f14daaad211d567ee199b6b2caa0992
GuLoader
9b4235ad000e2c60ee36599e355a2f7102a4b943db1075e02ff1036c0bc0ccda
GuLoader
9e56b9c890057c4adac0a54f64720736438dcc1ba3cce009c7b510fea603f2e1
GuLoader
9ebbeaf380d12e97972f57de2e052f1e043370d0be0bcd0deb3ebc5334cc68a2
GuLoader
a1e8840b05e211a9aa314ac0d4359068094bd9016c77b43591bc543b37e7022d
GuLoader
c3242f5a544110304212594891c9f8bb0c2e61f29d904271a09f5b0f94437348
GuLoader
d471a26ba030922f886a2ec9556784f9e38f07f8ae43281b7191fd7a34ef9750
GuLoader
+ 149 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ffkdbps2pn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar e5bdee1479aa7be3df31f777c90ed80ae083c7c3a8ac0282c5417e1cbd3df03b

GuLoader

Executable exe 95aa3a7cc02051435206105a14e7e78e76bcc633dc1731383f13ddfac7d7926c

(this sample)

  
Dropped by
MD5 404aeef8aff9df0b84e24ee415322b50
  
Dropped by
SHA256 e5bdee1479aa7be3df31f777c90ed80ae083c7c3a8ac0282c5417e1cbd3df03b
  
Delivery method
Distributed via e-mail attachment

Comments