MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c6ce0c9e8796042fe6202de1b60ea132bcf1c3c06dd4fdd305ec80ad3d17346. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c6ce0c9e8796042fe6202de1b60ea132bcf1c3c06dd4fdd305ec80ad3d17346
SHA3-384 hash: 2debc6966f15295c5c4a83229a5f1768fbd4bfeb0539aa2b33c6e3b3e51bb0265520f9883cb2aa5b5b6620a3805e124b
SHA1 hash: 5d559abadb42fb0fbf6dcd54f9cd99f2bb2b4ba4
MD5 hash: ab6a10f22cf87a9473fb0215fbf8f4b5
humanhash: jig-seven-mississippi-nine
File name:Shipment Document BL,INV and Packing list Attached.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:184'320 bytes
First seen:2020-05-18 13:33:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3f68b47aa08b210d2343027dcaa2b85e (1 x GuLoader)
ssdeep 1536:VXFXLCgJYcsuKdl8lbV/PAq9mk12mbHb/tjhPv92mlrcXVLEdiwXRCSjp:zOgJB4dy79ym3/TPvkmlIlI00Ce
Threatray 113 similar samples on MalwareBazaar
TLSH B8046D21F4C5AA0AD6214C7EDBE1CAB85596BCB00E11CD0771863F5F39F3906A76236B
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 07:03:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1ea315e9248f2e83decd8b9a73335ce654e787c42083c6e21566cd9bc2f93eed
GuLoader
6a5303bb0ea9067e348cb7bee1db4740682b5a3e37822d09d9b80783f64a5569
GuLoader
6b010a969661be1daa2a2866d318e0a8cdeed8a552eb4f4bd420d156751dfaab
GuLoader
72df3f9a494ac0d849ea6ba3917dfc37d7275f170f01348d3fd2ad77fb3d601d
GuLoader
76021aea3ce29a8755d97b4c13d16a7bcb9eb0bd6e1a2d1df62ffeb8fb9397cd
GuLoader
80e91c0ded60f7e85fbcba6239d2969c0910be5e0a5107a7f843ed2b30fb0ff9
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30
GuLoader
f8a6d117bfaaeaf97082bdab997196ebc517e34c45eda9b687c19923feeefdd6
GuLoader
fdfc7684865596ff802669590f077277385119144e11e6a1827910c39b0d5731
GuLoader
+ 103 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-34s5jjr17x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments