MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d18ad8db3ccb45bd0b3bdfa9aa444ebf49a2555d266d54dd44b2aa49451c7a0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d18ad8db3ccb45bd0b3bdfa9aa444ebf49a2555d266d54dd44b2aa49451c7a0a
SHA3-384 hash: 7ef0e6644648108799f5cf089b00cbab60ef5d377671de1427749dac816207c679248dbe84d52d54ec60510a5bd2808c
SHA1 hash: e03df5163728f41f048acd8b668df29d6ee25884
MD5 hash: e3920311025d7afa66a067264f8a9bb1
humanhash: grey-happy-carolina-eighteen
File name:BC1.1 KMTC PENANG V. 2004S.PDF.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:184'320 bytes
First seen:2020-05-18 04:47:08 UTC
Last seen:2020-05-18 05:44:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d5dbe77d9dca2dfac5a9c5c375e510ad (1 x GuLoader)
ssdeep 1536:1CW+CfPiGQMzQTRxRVpQ1Hv4kgyrzFWW1zSjE5SkWWkGmV70HaC7r+YGCxoTUqL+:4W+0KGrMVeB3VCjE5+GACN
Threatray 793 similar samples on MalwareBazaar
TLSH 51045B21F4C4ED03C620083EAFE58AB9911ABC744A11C90BB6493F5F39F2D16E676327
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.ELZL.27944.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 05:35:33 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2gfnrwz4znc32cz336u2urcox5e2evk5ezwvjxkewkvesri4pifa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1d117728ec260d80f6c6a347c4c32c965c69ff10bd4f08444fc70e82eebb1094
GuLoader
4c085d783c734f76e23572661c1692d7b2e4ad30dab5f6c108669d4141f97c99
GuLoader
6dcf4557563343e881daf4b7d7b01e372457cee637ac001a1102a2e67a69cbf8
GuLoader
7a7760c4a4b1244950ea0fd475c53005ced18cb314a2e0fc4499086582e1a5aa
GuLoader
8d88c99ff33ecbed42e4185b925f890a616aa0307a559d61595ab67dae6a1a09
GuLoader
98af60250a9e0cedaa66f04fe39c412bd0007855255547df68f5da46686c9ced
GuLoader
a3314185c4c7b813105231aa59fbf2045b1fa595fd4bf322370112926afc24a7
GuLoader
aee6f41ba3393811f2980cec1714785039dd6cfcc629b81479fc376f635868c7
GuLoader
e265bbf3f727ff892423b3e24b5368ab4f694c86334bf68ae62ff20dfd7ce5b6
GuLoader
fea3940f656c82bb8ed4668c67b6be0ecd1b72fc6d6ea52199c365ec03212a31
GuLoader
+ 783 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-142pf8f3zn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

0b1877af16d967cca52b1ca7d6cd7560ba44eba62a7dc712890a258dfb95feab

GuLoader

Executable exe d18ad8db3ccb45bd0b3bdfa9aa444ebf49a2555d266d54dd44b2aa49451c7a0a

(this sample)

  
Dropped by
MD5 427f8ee17f0f73ff7be113a1268a04bf
  
Dropped by
SHA256 0b1877af16d967cca52b1ca7d6cd7560ba44eba62a7dc712890a258dfb95feab
  
Delivery method
Distributed via e-mail attachment

Comments