MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a823a4702ff08fa0b0b70a2f781fe36db904ec2d975f58a5f9d44e85f4b85740. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a823a4702ff08fa0b0b70a2f781fe36db904ec2d975f58a5f9d44e85f4b85740
SHA3-384 hash: 83b4e023be4065e80490cb3507d9eec2362c78b078cf09f54bf520cf6b8a8f41bab4181db797a58c2c8aba42bd65c36d
SHA1 hash: 881f10ac008101e40f15718ac11dd4cbdbae18bf
MD5 hash: ad4ac5402b621ddf116e46cca7af93a3
humanhash: pip-snake-floor-rugby
File name:a823a4702ff08fa0b0b70a2f781fe36db904ec2d975f58a5f9d44e85f4b85740
Download: download sample
Signature GuLoader
Create hunting rule
File size:364'032 bytes
First seen:2020-06-03 09:00:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 173abfa8f7d7adac2a90a2e42625b7d9 (6 x GuLoader, 2 x Simda)
ssdeep 6144:U3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:fmWhND9yJz+b1FcMLmp2ATTSsdS
Threatray 24 similar samples on MalwareBazaar
TLSH 61748E21F1C0807AE4F5157096FF7A5B246CA9B6472838D7E7986EC928741F27A3C2C7
Reporter raashidbhatt
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-6323528-0
Create hunting rule

Win.Trojan.7348569-1
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Shiz
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:08:29 UTC
AV detection:
30 of 31 (96.77%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
071c9ef8d382452d6bcaa4a46eeb4a0e71562097201d228caf15229fd2b68ac9
GuLoader
2ed58cba6fbba892cde349ea6759ddbe197bcc1adf9c55801b30ccd3d28ec55f
GuLoader
347ec9d5455536ace4c650476001fb0511d5ea5f734a951b523ade3001472dd4
GuLoader
48b9908bc98ae2903ee34167224b402fe5eb3a6c9b853ab17e728de52e2639a0
GuLoader
68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2
GuLoader
7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b
GuLoader
9b322d3c3a5bd842ae2563f5eb2ae4cf7957132311ccf051d7bfeb4601866a33
GuLoader
dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc
GuLoader
e162d29d0ba895e3ea7d75000c41c843225c7d29147b323ed9a72f4de3c1f6f0
GuLoader
fde7c52c166cd76fea454bbb539e7eba9ce704f5b442534bf5c4163213215426
GuLoader
+ 14 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-lfxw5fnk7j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Modifies WinLogon
Loads dropped DLL
Executes dropped EXE
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments