MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0be5fa11ab4c6482cccddbc8eb111026c577cdf2b28ef6ee6c16bd34415d03a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0be5fa11ab4c6482cccddbc8eb111026c577cdf2b28ef6ee6c16bd34415d03a1
SHA3-384 hash: 9b97f3c678af833a6761fb1a43263b5f9ab7724f8dfc4b68e30e672e6edfc6a9c43db84aa9a2de1c45cfba9b42123e7d
SHA1 hash: 58791e39a3814d8b58b2e469fe6d68e20abd19af
MD5 hash: a285516e222e54de4c1c27d3ce907868
humanhash: alpha-thirteen-oven-fourteen
File name:inv+pck list+Shipping doc 006.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:114'688 bytes
First seen:2020-05-20 15:16:31 UTC
Last seen:2020-05-20 15:49:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 600a17905600228c6eebb4c834c1f092 (1 x GuLoader)
ssdeep 1536:4bYlEdUEe5F++dAL65OYsvaKBVMmbZvXsoV:4ciAFeEKBlbJl
Threatray 275 similar samples on MalwareBazaar
TLSH 2CB3B322F758E8A2D52044BE1F92CEA811D3BCB859A6E70374D1BB0E61F1CA5D671337
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47512.18815.18825.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 15:35:28 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bps7uenljrsiftgn3peoweiqe3cxptpswkhpn3tmc26tiqk5aoqq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
2c80f61e5c61bb87be9e2d60e69093bcb5082fc690fcd751be787dbd118d5e57
GuLoader
3d8567fb3b55c792b8ba70e2172726ae80805f1a1c858db29e13a5cd02d8634a
GuLoader
4d02a7969e34cdedb37997496c951b9e37f40eb8228deef6e436a3781ce00966
GuLoader
6fd66c1d011fe7b8658211ad8990d9b06d23722a50c407675112ffb879043fa5
GuLoader
7294bdc3333d08ac9c2397b3555c0126928c13600b23de09f21841cfee83f55a
GuLoader
7c58672f646a85dd65ae2c5d44fdcfb899584a9a27650418a06ecc495cdf7a86
GuLoader
82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
d725785ec3970b75ecb17a7e5ac14d93ce7a54d259dffc74e8222ed8cfb8b6b3
GuLoader
+ 265 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-8zc6ynwzjj/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

ace bd296aebd795d8db6a71b9195ee3c7751fd06b292ded225952a26893e203252e

GuLoader

Executable exe 0be5fa11ab4c6482cccddbc8eb111026c577cdf2b28ef6ee6c16bd34415d03a1

(this sample)

  
Dropped by
MD5 9350823d9bc02f14db8a6ee4ebb7151c
  
Dropped by
SHA256 bd296aebd795d8db6a71b9195ee3c7751fd06b292ded225952a26893e203252e
  
Delivery method
Distributed via e-mail attachment

Comments