MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 133b27bbf63dcf79d89bbf8b46be58d0219323be3d3e428f5e1c7feba7c55f89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 133b27bbf63dcf79d89bbf8b46be58d0219323be3d3e428f5e1c7feba7c55f89
SHA3-384 hash: c49e6cd179e5a333d575675a9d7d24aa1d2e0837aae819f9af821f9755ba318ed80b958c9e41c810de9c1049a99595be
SHA1 hash: 235ba7fe35ed84a619f1b02ed106ab4ff58be31a
MD5 hash: fa0c65f4fddd5d8accf03c0f3a939747
humanhash: sixteen-april-triple-illinois
File name:SecuriteInfo.com.Win32.Injector.ELUN.28117
Download: download sample
Signature GuLoader
Create hunting rule
File size:143'360 bytes
First seen:2020-05-07 08:44:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fc3e8defa0a23c906cbf8fa1fc8e7483 (1 x GuLoader)
ssdeep 3072:wAVa5WP8t/Jc26qIpJkBPEy3U84J0oWVgIhsUEVb1lsh:Tqhp6DpaWy3wJ0xVg4bIb1ls
Threatray 159 similar samples on MalwareBazaar
TLSH CDE32F949A98EC13D49878B2EB82F95DD3942D35B8327213B3C0772E2B35591DE2137B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.ELUN.28117.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 06:31:18 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
025ce893661f87afc7352a9f89403e337a4e6d982ef3d97cf19e74674cbdeed3
GuLoader
350b35550e10e3ed50b1337e8899ab2eb9c9cbae7c077027f52bab3c5266bb84
GuLoader
5da6c70f145dcb4c50abe95e6b641d3a4c24fbc74f02b19aa40e574b25eaecba
GuLoader
7ab96517f6852c124c82edf441496b2f005b11a4d1feb92f9cbfa2a2bffd1acb
GuLoader
7cfa97a92b4242af9657fe87263b30a68d06f7d360c565f362794618713e1774
GuLoader
7e60af333b52731e98a3c49c7e0ecca12d86c8277f4e6f8f118fd021beb5acbe
GuLoader
8077b9d3b809c1b66793e7292d7afdb401efa60fe9be607bb48a30bcf005af06
GuLoader
aebc89bfa14151d05e181e1330803a2d0903a45b0b768bda238f4676ca9d65c7
GuLoader
f1e6db23f71358086c0a6d54602989535e6c25309d92af9f0db056d4a372fe8e
GuLoader
f6cbd9ef6fbc0c2774a4bf2e43aa01804ee0294a453e8254f5a843a40051da31
GuLoader
+ 149 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-vwlhebq77a/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 133b27bbf63dcf79d89bbf8b46be58d0219323be3d3e428f5e1c7feba7c55f89

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/359310/
  
Delivery method
Distributed via web download

Comments