MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd6f8c6b0d3ba7d364667c32994f536d69d93aee58e46ef1e9899452830c001f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd6f8c6b0d3ba7d364667c32994f536d69d93aee58e46ef1e9899452830c001f
SHA3-384 hash: 4c8f815fd635165b80e51e6a2a6444d8367f59093570ea63de489129fc7aed01ddd661f384525bdf7ef39f4036cc6777
SHA1 hash: a1840e33168062cf5b2087e3173bbc6b239609ee
MD5 hash: 90c422c466b94ff62e03d9e2b50ac378
humanhash: lemon-one-five-early
File name:SecuriteInfo.com.Trojan.Siggen9.44511.16444.24233
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-08 16:10:09 UTC
Last seen:2020-05-08 17:04:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f46b10eebc3c9c499a09f8d08a9a4736 (4 x GuLoader)
ssdeep 1536:4zPCYqMi12dkyXxeSX6nhibUXXkfr9yaFT:6PeB2dtXinhq
Threatray 102 similar samples on MalwareBazaar
TLSH D293D501ADB4ED25D655B6B5EB3AF7AFD316BC301931480B20C53A1D6F36A128D3126F
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44511.16444.24233.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 03:36:03 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1f3c0cb514e5c47627a6f0947deec29e824dfb0d13121021ea6115d3f09db9ee
GuLoader
1f970a14fb1efcbcdca7c274d76c4eabd3699e62015a58226d6e328b83d4f0fe
GuLoader
3fe9eed0a3a27ff6cc16b6999d5b040cb7c103a4cd59262ffd21744537e7c8db
GuLoader
430503a02927d70df40c2f5649ca255e98017a15af6796633c27d2c0d3f3314c
GuLoader
581a5839e84c512e1ba78931b78cad6a25ad5ec0c6033d033db3350889285c9f
GuLoader
6f3800e20217ce801b5c4106be5fb1160e4accfd565e371b670c52605f2600b8
GuLoader
7fda87ee7ea129f8263c57c5f9d4ed2db3221a067ad0d3dee0a1918d4be96b94
GuLoader
9826cc38078ee6a4a6ac24f17da67a7848eba1c75250875aac17bd1496b2bb4a
GuLoader
a2854003ec6cd974aacccacca9e7d12208e1e70dc2c3d722c238bafb3aa3ee26
GuLoader
b3f47169101e8ad239ae4a647447bef75e9ec88d5fc096299880756868514ed0
GuLoader
+ 92 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-zm5ferlqnx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe bd6f8c6b0d3ba7d364667c32994f536d69d93aee58e46ef1e9899452830c001f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/360021/
  
Delivery method
Distributed via web download

Comments