MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e20afb0d09a4e47be30404425e599d42071b310c01f0d9674567a4f3e284b62c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e20afb0d09a4e47be30404425e599d42071b310c01f0d9674567a4f3e284b62c
SHA3-384 hash: 57850f7b3095cf89473be5af28d1897c70e50913c789af2d8d81e8b5be8e6428610470a6924ed01c854eefb0cef62622
SHA1 hash: e6ff36485215738197441e59614bf690f005d107
MD5 hash: 90a415c63c5d747e6fa8fc9ff5c58500
humanhash: connecticut-lima-jupiter-michigan
File name:SecuriteInfo.com.Win32.GenKryptik.EJVZ.12847
Download: download sample
Signature GuLoader
Create hunting rule
File size:114'688 bytes
First seen:2020-05-05 01:44:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4a8b6ef224fbafe9e7eb51f31625543 (1 x GuLoader)
ssdeep 1536:Mh4+AACLrwycXC7+Z7eqSpo4escZsHuUML3Z:p3cX2qco4tcwuRJ
Threatray 319 similar samples on MalwareBazaar
TLSH D0B3FA995EA4EC23C45D38F2EBA4F15DD7602D381832A6537290732E1F385A1DF2276B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EJVZ.12847.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 00:26:32 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
234563f2949217b4a1ec8e9d80c9f353ac82ae7baee24ce29c5eab37b6dddf29
GuLoader
2a4737c791956f7c020af62490a855297096797a632a39e493ddf19365916456
GuLoader
60e4a90b0d8ac89efe92c67bdabc39b364459d7440bd435ad653d667dc57d0ad
GuLoader
65b63f4f75c7b4e0c164a93957996ce074fc3a0e7a42d56fa53137ea2c060e5f
GuLoader
80cc2999c2dd412c72032c3923aac5a80aabe9e86a8f4579fa7c807f45f669f0
GuLoader
84f409f8aee0cf253fba68ae4027348449045f7bfb8723ac8fe0336c21c0b0f6
GuLoader
886cec0fe0e68cd029b2f082e65009e46205d4f4fefa5d70923031ab5982fbc1
GuLoader
a102ce665ad68d76c1fae745d9eb530e801efa07e16672e07792f202958da80f
GuLoader
b297410a0f739e14f1b7821da518304de8467d9dfda17dd9d45dde4ed8744e9b
GuLoader
bb8510a80af2965bdca1fdb2218ebfaa2a72402c0b767c3fde6b7807baa647b5
GuLoader
+ 309 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-3bpp8hhyq6/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe e20afb0d09a4e47be30404425e599d42071b310c01f0d9674567a4f3e284b62c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/357898/
  
Delivery method
Distributed via web download

Comments