MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b161b9398f1f28f73c9bfaa6b536cc8bd49d1de076d78404f9a1fe181ec02b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b161b9398f1f28f73c9bfaa6b536cc8bd49d1de076d78404f9a1fe181ec02b7
SHA3-384 hash: dbd6411219762b383846a5873b090ea50978d0cd810c5c508131c0d467c9b876790b7dc41d3989ed6ef3b6b4d2b824b0
SHA1 hash: 4d64d69dbd277b11fff8d02a425c8432be607e44
MD5 hash: c3d3cc6368fe362896920a07c752af20
humanhash: monkey-diet-oven-whiskey
File name:c3d3cc6368fe362896920a07c752af20.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:143'360 bytes
First seen:2020-05-27 18:27:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4545c1409222a032924e621099a93524 (1 x GuLoader)
ssdeep 1536:IEnOgr2dIhT0Ayos/ZV1PgPpjErpDeqkmi1KUF2SfA4Z8x:POY2etyos/ZUP6r8qE1x9fvQ
Threatray 156 similar samples on MalwareBazaar
TLSH 33E365127EE6AC7EC5997DF1AC8969962A063C11BF00176F11C5F7BD32328E12C91B1B
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://45.143.222.30/Frank%20May%202020_PDyqE221.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5776/
Detection(s):
Win.Dropper.Fareitvb-7915961-0
Create hunting rule

Win.Dropper.NetWire-7917271-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareitvb
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 18:37:10 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1ede635c9e8e470e911dc46b40300cd2e794703cedd0f5487d9677244864741f
GuLoader
23245166f5cc80f533d3b50ac54e614aa646a5547ae956b9a8957113b446d42c
GuLoader
52f137c22685d15df043daabdb9c823e07ecec4df42bcc2fa2c5bd45913d32ea
GuLoader
8780cfbde0db4996b68e320d9d2576f39a2d7f99a8ed60ba0c4e543f17801bd9
GuLoader
9809e7b9ac68c6e45309bbaa600829cb8ff32a48002ca799aaa8005f7e21f262
GuLoader
b5382684cba90f427975d7be5c938b3216b38f0f00e617f36c71535e4deb8059
GuLoader
ba4b1ece1f0d42d229946e79fda474ea6d417b7f597bcea4199e0f2d0baea666
GuLoader
bc2cea17da33c23edbb0c86ab00b3ec3b4a2f4da84fb075922e41b7bf6b654f0
GuLoader
f5f2578101553a0f24cbeb4f1691d37232f62d4e5986886116e2939272555844
GuLoader
f6c6a59c54373d9a49e7a5a7aa859d6bda9f5826e4bb652f5898fa78c8748f39
GuLoader
+ 146 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-9g2jclw1w6/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 1b161b9398f1f28f73c9bfaa6b536cc8bd49d1de076d78404f9a1fe181ec02b7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366578/
  
URLhaus
https://urlhaus.abuse.ch/url/366577/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/5776/

Comments