MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 025ce893661f87afc7352a9f89403e337a4e6d982ef3d97cf19e74674cbdeed3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 025ce893661f87afc7352a9f89403e337a4e6d982ef3d97cf19e74674cbdeed3
SHA3-384 hash: 3f384b54698f3c08c3e96d71678637c888eaff699c72cc5362cfcbb9a494c9f0a0c02d6dfeb7232167bacb38e66bc9a3
SHA1 hash: c1e1eba146dacfc2e81f551404bcc900417a3de1
MD5 hash: 444234cbc19ecbec309cae9cda20c920
humanhash: lactose-march-river-pizza
File name:facture non apurée.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:143'360 bytes
First seen:2020-05-11 20:41:56 UTC
Last seen:2020-05-11 21:49:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5486c20d9f6a3d67b3a5edad69579671 (1 x GuLoader)
ssdeep 3072:yy81/Pg2iT/Yp6kBPElD8NRQtEgT3JRIhoUER/ZxHh:kXNispVWlD3tEwJR4Xs/ZxH
Threatray 143 similar samples on MalwareBazaar
TLSH C4E33F994B98EC13D46878B1EB82F95ED3942D35B8326213B3C0736E2B35591DE2137B
Reporter c_APT_ure
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.713295.2647.5437.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 07:26:32 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
133b27bbf63dcf79d89bbf8b46be58d0219323be3d3e428f5e1c7feba7c55f89
GuLoader
399a07cb8e62e14926c917d66f33b1d2e441a8fc795ca26ac00514f8d96ce638
GuLoader
50ca73e510646ea1534f248099ce844f7f6178adb93055f8459ec07645f48e79
GuLoader
5da6c70f145dcb4c50abe95e6b641d3a4c24fbc74f02b19aa40e574b25eaecba
GuLoader
7cfa97a92b4242af9657fe87263b30a68d06f7d360c565f362794618713e1774
GuLoader
7e60af333b52731e98a3c49c7e0ecca12d86c8277f4e6f8f118fd021beb5acbe
GuLoader
8077b9d3b809c1b66793e7292d7afdb401efa60fe9be607bb48a30bcf005af06
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
bde46cf05034ef3ef392fd36023dff8f1081cfca6f427f6c4894777c090dad81
GuLoader
f6cbd9ef6fbc0c2774a4bf2e43aa01804ee0294a453e8254f5a843a40051da31
GuLoader
+ 133 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-sqpthvtt76/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments