MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c86b7ceab16758dd8095aaceaf939cecb1c533d7389a60285bcae4e6b4896ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c86b7ceab16758dd8095aaceaf939cecb1c533d7389a60285bcae4e6b4896ae
SHA3-384 hash: 2a47b1182bc429ff0164ba3365d0b07b174e5105f1a6d636e284d1d502e27fd3f996706376e44f0c0a91d6169052d8ba
SHA1 hash: 7f6caae243eada088e99b345ef060a557b5ffb1c
MD5 hash: 58b4768d19a1f4b120f8dd3310000d1e
humanhash: queen-seventeen-uniform-seven
File name:NOA_COSU7221931450.PDF.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-13 08:10:17 UTC
Last seen:2020-05-13 08:52:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 84cb3787f909f8a03fe3ad5037bf8754 (1 x GuLoader)
ssdeep 768:UtqkEjOVXBS0GrkRSwsjISBaxFJsgBsxzUjvoArSwLbelZdFafMhU:nORBS0VSwsjDBmFf0MMih
Threatray 642 similar samples on MalwareBazaar
TLSH 17930B12F5544927E7968BF297788BFC515EEC302A11480B36C47A1E8A3BB46F73127B
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.ELXQ.9261.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 05:04:12 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bsdlptvlcz2y3wajlkwov6jzz3fryuz5ooe2maufxsxe422is2xa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
298be508522121999d495c3ad893490264f9225bc09e15aeffddfd52fcd0deea
GuLoader
31b91244dc7f952c94684ba63aef5d07cf85ff5844604d63390ed1d7d224459a
GuLoader
572b91e53db1d2433ed0fea0b699e9137d051d0b8dd67fd2a142c3eeb742b05f
GuLoader
57aa81416cfdbd76df2a15cb14810f8529ecab0eea978210a4ef3047f35a225e
GuLoader
5e3e874b7f87124567d4716a6f0e8d696bae261550b399649a9fb3a85f2e0d5a
GuLoader
630ff6cc27be458de812bb51580a983819505b604f68e14373338a05bed0ee6b
GuLoader
a877edd01cd23c7ab7846c5f8e8820accb33965764770341300354f346a8e7b5
GuLoader
c5ff41e95d55a5be73417b732c5489578fd81fdfb3de455081bbab431c5cc127
GuLoader
cb123f59fa91cdeb85c89a5921a9aa4e3948c3f5bf996da81a19d86ba89bc20a
GuLoader
fbb7024e3cb635d49b69e56354fd69915a4b2a2e57f03bba818958d2aee5d46c
GuLoader
+ 632 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-lvhb2zzp8a/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

42069059b6ecc9cf55711ba998f17777c864253158a524819e8036dbe11262f6

GuLoader

Executable exe 0c86b7ceab16758dd8095aaceaf939cecb1c533d7389a60285bcae4e6b4896ae

(this sample)

  
Dropped by
MD5 51c1419ce5433b9f2914c7d6975bdd61
  
Dropped by
SHA256 42069059b6ecc9cf55711ba998f17777c864253158a524819e8036dbe11262f6
  
Delivery method
Distributed via e-mail attachment

Comments