MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a1a06e6295b998e4bad7a627623b20ca2cf4a2aad41276c8887877553c14996. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a1a06e6295b998e4bad7a627623b20ca2cf4a2aad41276c8887877553c14996
SHA3-384 hash: 80622bc769cce9c41ae0957739ff09904177b4611f0b63908783629e72a5e1ccb7a84fbfef58f2133ab24285502778bc
SHA1 hash: 9ca29cfa224d8ecb9ffe89e71a1fe8aef1e551e3
MD5 hash: cd1d0b7e87791f9c9e184debdcf92f0c
humanhash: muppet-beryllium-oxygen-pizza
File name:cd1d0b7e87791f9c9e184debdcf92f0c.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:114'688 bytes
First seen:2020-05-27 13:00:47 UTC
Last seen:2020-05-27 14:13:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0d57a1d3594bb10f89f3775c4d1180bf (1 x GuLoader)
ssdeep 768:r4o1QTQ48ncgHxnBlrjEzyn77oHRMcFy0ugKNM/qvslceQvOdgy2eJh66rMA/:co08c2xYy4xMcFyS7esAOdI9e
Threatray 458 similar samples on MalwareBazaar
TLSH 38B31A13B5D49CB2EC748FB20C7AC5A05D36BD3979910F077188FB9E393699A299031B
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://45.143.222.30/Eric%20Baba%20apirl%202020_oVysjOz120.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Nanocore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5710/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43228788.3010.6870.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 07:35:19 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0992e4668212efdaf0f5bd92983ff0b50f4024bd6f5fe5e4e77c2816e62e8504
GuLoader
6005ff1373b7a3600ad4b5700b4d9b6c13827015a97fea1b030189655bd8e986
GuLoader
67b46301815d5ba32f90af114a459810902ba6d97a75821c8455b8103073b499
GuLoader
889352094880e37d9fb8d07ca965839f595ac5b821996f4290149d1815981a7b
GuLoader
8fc4747ee4e9b358ddd1dffff19b0b3f5166e8b4ef15257be68d3fa2decb347e
GuLoader
a2bf3f45bdc745f100e74e154249ceccf3339a09de63ebd1118b50ed7a305a9b
GuLoader
a40f7767aa2fd1c3efe1fc0f0178088d1640d1a2fd5b4d4b075f8bbff43ccfd8
GuLoader
a5e798492ba6892a57c79c635679563eceacb6d1efcc38f5dfc0232518861ca8
GuLoader
ad3bb3f26289dc46ab58afb6cdf67ca9a256519fd9d087a418f849f9bcb78c25
GuLoader
c7d7e6c6dc477e5fdb2b2a26eed1b53e77d455dbec8df800927a5bae69a2cc10
GuLoader
+ 448 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-swr6hjtfcn/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 0a1a06e6295b998e4bad7a627623b20ca2cf4a2aad41276c8887877553c14996

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/365489/
  
URLhaus
https://urlhaus.abuse.ch/url/366806/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/5710/

Comments