MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c97b1735ac5cb99698e1b422244a6b7b0041ff9acc25eb945ff55ebb317b06c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c97b1735ac5cb99698e1b422244a6b7b0041ff9acc25eb945ff55ebb317b06c7
SHA3-384 hash: c72fc70ab60c05590a31ed1bbc1310a60ff2932ba35e9f80b47360b53413dc153c00627c15017b38fcb132bfdfde32f5
SHA1 hash: 5b4096015f8de9e1a3a740899371f86661c511e2
MD5 hash: e6d56f61b2b2b69f644649bb1d6b66c8
humanhash: freddie-monkey-potato-shade
File name:dres.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2020-05-04 04:44:32 UTC
Last seen:2020-05-04 05:54:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9608db70e322f4feedc459f2b03b2b71 (1 x GuLoader)
ssdeep 1536:jXetGGqO5I5ZsQQFkDBUgX1xIul0hEnX1A7:retGISzsdqOgXguKhV
Threatray 157 similar samples on MalwareBazaar
TLSH F6A30857B3E4900AFA2149B66BA8D3E44056BD39DC411A433AC8372E7A37E45FA5133F
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EJUR.7297.UNOFFICIAL
Create hunting rule

Win.Malware.Generic-7751004-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 05:35:45 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zf5ronnmls4znghbwqrcistlpmaed742zqs6xfc76vplwml3a3dq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0940b9701bebcf58004ba4089e5d0d6ebbf882da6fce307f24b254f243063439
GuLoader
0e2ff65bf3e2ccdf8a5c94830b0c8b72ce136d017f47bc14933ade45b9bbaeea
GuLoader
10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821
GuLoader
14bd280177ece118d671795a8b372a0d7de0f3ad3b842ed35726d9b587cb1608
GuLoader
1d335da5b4f011225d4de68f7c3f835bb88a391d6d1046f539756e4d4f612a6a
GuLoader
40950dcb88e56bcea0e542f297d60fe5a96d410473ec3fe51e9234b40304d329
GuLoader
8780cfbde0db4996b68e320d9d2576f39a2d7f99a8ed60ba0c4e543f17801bd9
GuLoader
9028aeddf4c76b16753ea37720bae4088308671214e6cf192705622cf07d41e5
GuLoader
9059531fbff89a14fc3761330cac92437bee44349e6b62e7e807422b4c57e2fe
GuLoader
eaf38de6ac4347ac84bcbe648301fedfe021aeafbc3bf40404a4003117a8967a
GuLoader
+ 147 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-2f7he5ddrx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments