MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1240a7ff417004b8b3b98ce0d7adc1f959178e730590b45b2cba92c473fc0b89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1240a7ff417004b8b3b98ce0d7adc1f959178e730590b45b2cba92c473fc0b89
SHA3-384 hash: 3e7c32d303c0edbf81c403b9e5d9df2025d66c4e683d9c327e8c904be40ed8d1bb570abbf8d4c0edb0ba5a775ba0eb67
SHA1 hash: d281b0023b65840090b1556560e4e5b62d3c8f0d
MD5 hash: 7aec83dc0d2d96e02b0eefd1c6a4f808
humanhash: may-ceiling-sixteen-sodium
File name:SecuriteInfo.com.Mal.FareitVB-AC.28003.1955
Download: download sample
Signature GuLoader
Create hunting rule
File size:126'976 bytes
First seen:2020-05-08 18:11:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5c319a062d4a88347ab0cc70095d915c (1 x GuLoader)
ssdeep 1536:eaFwjwdEOYR88kdIlTQKu707gXSVcgGTKwAvrL+MkO4XMVKpR5YWo:eKw0dEGKQ/707gXDxKZWlO1Kp4
Threatray 151 similar samples on MalwareBazaar
TLSH 26C3838637C0F657D5E80EF1531A43D125F9AC3AAD862B077BC8B51B6639E41EA20373
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

SecuriteInfo.com.Mal.FareitVB-AC.28003.1955.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 15:48:27 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
042359241a3a3f4d635527751c2268cc80121586dc68c9a6732edb20d25ce760
GuLoader
251823645d1460928c1fd5f7cb861fb31e690238bb2707b2f2647baff98f9ca4
GuLoader
380f06e9a34d63f3b41e94cdb6781254e7582c811adaaf48855d4e945e8f96b0
GuLoader
4c567d47335c4c7a99133643e137e824203b8958b44e1c8a0aaef7a6aed39cf1
GuLoader
677825d1c55ffae0ee20b966bf6e7318fd6e0ccbfa1c65a1c42d19997fcbfc06
GuLoader
9532627f43a3de7b9c4414517f18197a08969adec3c24e1c2f1856e32613d5cd
GuLoader
96568402add3b23971d79fa6730a1bd054509512e1d73cefec74c307aa46d436
GuLoader
9d88f50d2a47b2339497c9ea6cb7cb1f669865e1e8df8e9363b147b0fdc75aef
GuLoader
bc3729fcbb326ce373f348d481a61f6d4468c6013d3c712224c54a64c9c278f9
GuLoader
fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b
GuLoader
+ 141 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-49wmhmmvtn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 1240a7ff417004b8b3b98ce0d7adc1f959178e730590b45b2cba92c473fc0b89

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/360038/
  
Delivery method
Distributed via web download

Comments