MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac9c0fecc457b7631f55b6fab8a52b92546b5d6eaf3cd55cebb085c783e4adf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac9c0fecc457b7631f55b6fab8a52b92546b5d6eaf3cd55cebb085c783e4adf8
SHA3-384 hash: 4699dbf71a51513ccbb02de31d9eed3511879082f98eebb43f32656fe5f0361130853aca02fb3aacc4c647a04ba7dd46
SHA1 hash: d624b447ceeda6de5238c5866cf0c2043bfad7ad
MD5 hash: 0826955cc1bcd8b8ebb6677e9f3f8be0
humanhash: mountain-ohio-black-comet
File name:danap.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-25 14:43:59 UTC
Last seen:2020-05-25 16:11:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 033db7e56d32e9c3180ad795206c1fd2 (1 x GuLoader)
ssdeep 768:/GP7sGJnoQOjOtwWj5Bnjzs1gStG4jpKvrzteBzKYk:ezsGF7YOtTVtfsCStTpKvrpm+D
Threatray 223 similar samples on MalwareBazaar
TLSH 14934B1576A4ECF3CE004DB38A52AAF8185BAD31690A8E1774C9377C7C37E97661831B
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/5577/
Detection(s):
SecuriteInfo.com.Variant.Graftor.754947.16658.5218.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:43:50 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
17c1432427baae5d78a79ec3b031e7bd1cccdd7aa87f8334d828ed15669b8337
GuLoader
2882a3ea96a1a8ecb97c338a9903d110b1f2859bd424e6e34153667b29d876c8
GuLoader
2a8b84761200ff05a63ccc2f2f8d2d95e55bacbf3dfa425b6d0a1d0228fb8078
GuLoader
396c67d17bdba56c29d4774991879313c236e9db5b9e1173f322d1bd3194edd1
GuLoader
3f88c57eb7f5eb4e623183ce4b3d06ad3987000282cb09b184a9854fd592c766
GuLoader
5e65e89ec413345a3e2b5476b6e639423e955aa3a34e36d82d621ed15e53383e
GuLoader
632562060da02f7ed5e92b1fe1bd94ce8d993cb134e93f8294beade2f0f42974
GuLoader
739d40c80783a52ae341907b2996cac8a4a51189c176d9e3270a74c3e9d7779b
GuLoader
9b330bb1491b230182ada7cd439a91edbf552bae7494a2ce6ebf55726660b086
GuLoader
f5f22da770bfd33da2fa26f353f66a96cb4fa0304b885949db4b2b50113b090a
GuLoader
+ 213 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-a12xhspjta/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/5577/

Comments