MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10fb1047794d9a933f644978c5bfe1eb5dd2d66b87489823f69ca414d2688537. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10fb1047794d9a933f644978c5bfe1eb5dd2d66b87489823f69ca414d2688537
SHA3-384 hash: 3e29d5131daea93380cff07f4ce50bc8e6d4962233cce670c94c8a90a7c1027842e8b4a5fbcdd59004b24ec86e168b34
SHA1 hash: 52d046fe3bb527307715d93a63e0c32578e6e571
MD5 hash: 74d86a2ef54a502c753f3db820dc2e85
humanhash: maine-bravo-fish-spring
File name:Baandspr6.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2020-05-11 20:19:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 28e8f2cdc0d13b20a58ad166880d0dda (1 x GuLoader)
ssdeep 768:ew5lVlW/nDk9KzKe+dSDmtKGLfZpjlwZBELgGJYHldP1KwVpr0c:rGDWdSDmt5LfPlaBELgvH7P1Kw/T
Threatray 238 similar samples on MalwareBazaar
TLSH 6DA3B429AEA4ED13E568BDF2C715B26EE3C15D7524B14A0373C0B62E5F79901DC2232E
Reporter c_APT_ure
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Win.Trojan.VBGeneric-7781632-0
Create hunting rule

Win.Malware.Vbcryptor-7781695-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 22:17:15 UTC
AV detection:
24 of 30 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cd5rar3zjwnjgp3ejf4mlp7b5no5fvtlq5ejqi7wtssbjutiqu3q._file
Verdict:
malicious
Similar samples:
463bda53d68b37fa531bc31652d2f76a92c76f3311707fb7a0037b4f3a5445d4
GuLoader
4fe68ecc976811b7c7acfd841f0746446f97e271b40819e93a35b17788767f9f
GuLoader
65b26141d162b4b392d2b18c07056bda8aadb778445f3fae73c9e75d6b639ecc
GuLoader
8179d0b5e1307621aa793c502a89ac3b7aba833f3b4fc815f99d0dbc85aa7c06
GuLoader
af9f1fa67d9f21a777af09c9edcd8eba3765b556551a04dcb95b8163cd3b0c6d
GuLoader
b00ffbe33a4398cdfdb136564f24dfd6ff292b11a9adbc4041aa2a532af6edfb
GuLoader
cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1
GuLoader
d3e501926c12ab2f5229619940c2c4e296e85a06606e69f575a00932c3d1ed30
GuLoader
e30821af035b182de6dc8b54d9506383cd5a5713c4448faa4c842763371063b2
GuLoader
f86f0b271ee898a5d1744cead6bfea148e81f557a8f2bf581eaf764afe206963
GuLoader
+ 228 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ty4nkshr86/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 10fb1047794d9a933f644978c5bfe1eb5dd2d66b87489823f69ca414d2688537

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments