MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15187de4f29194c60f3f199549c345592e967ee8ecf9a39b0a40c1796fdb222c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15187de4f29194c60f3f199549c345592e967ee8ecf9a39b0a40c1796fdb222c
SHA3-384 hash: ada5e7e7bd6d55a2c17dea88d1ca65b02a4d4840690d2f7972c7f55eae11d9df0caba4c5ea9131474835ca0d68b400da
SHA1 hash: 94c718e10f4dda15cef2980ad1328007a6e86c7d
MD5 hash: 5f05cdfffa656c9343d675477888c4bc
humanhash: orange-colorado-alaska-fix
File name:SecuriteInfo.com.CLASSIC.15961
Download: download sample
Signature GuLoader
Create hunting rule
File size:106'496 bytes
First seen:2020-06-08 15:35:47 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 1536:qE0NLuRtSBKLgmrS3zCdZriaC1lm1tTkrSylhMiutR3+:qE0sFLSGISUhvg9
Threatray 987 similar samples on MalwareBazaar
TLSH 46A38D077614C607E0650A702CA2DBB95B26BC245D412F4B30A57F9FEDB2B526CA733E
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CLASSIC.15961.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 14:12:42 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
01cbd7ffa69b802c48571c9643d525c525493463b592a79336ee6757e9d54aa2
GuLoader
187c0f3510e1435dce3980a2ef3dd20b44a694218b3ba633afe266f23cff03cb
GuLoader
5f9b8ce62abc0d49b1bb253bd51286151a8b3d3f09fdb9e37cd964f80df26669
GuLoader
61b5d789c9983fb294e4e91fdcd1487c896fbc12a0a605215a48f589b6fb4937
GuLoader
7f7f93ae7c3ce6bd7d154c2e2188bd39c7d511df8fc890e46085afc34acdba2b
GuLoader
89e54f19c04bb28c90f0ee75419a149c8178f9841435a20be727506d0c9506d3
GuLoader
8d4b6b5a3f228456841a6627f6b4fe4de260e1261e312b30b62120d5297e68c1
GuLoader
8dfca70c89e2310b9f8af5cff4ace9dc09676db2e19950afb205518c581f9627
GuLoader
a570592bf5a21c1f55712fcec60a0536fedabe28b409d9a48fdc499185e154ff
GuLoader
d894062069e0d2967a0ca5655892f29e511d37dd5de5f5dc02e7ed54f2e4fe45
GuLoader
+ 977 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro persistence
Link:
https://tria.ge/reports/201109-yhbtc9w9je/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Drops file in Windows directory
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates connected drives
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Microsoft Software Installer (MSI) msi 15187de4f29194c60f3f199549c345592e967ee8ecf9a39b0a40c1796fdb222c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/383165/
  
Delivery method
Distributed via web download

Comments