MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e5ae0cad52869f12ca373c2e29ab46758f723060291f611fd6e1512ac0480aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e5ae0cad52869f12ca373c2e29ab46758f723060291f611fd6e1512ac0480aa
SHA3-384 hash: 073ceb05a37f815fd1dc0862e7264f90ac0d5d3f613e8e91d3b3c8799e6bc4168499af680f016853afd2086e94819c91
SHA1 hash: 2089b9fa55b17a9c5206f7962f3dcbc7be11bbfb
MD5 hash: 1098eca2ccd7aadf808f04359cb8cd1f
humanhash: asparagus-muppet-zebra-black
File name:SecuriteInfo.com.Trojan.DownLoader33.44791.14012.10581
Download: download sample
Signature GuLoader
Create hunting rule
File size:73'728 bytes
First seen:2020-05-23 02:42:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 53b71c0bd6a7451f2ada89e075dd6445 (1 x GuLoader)
ssdeep 768:nq4SoVL8OB9B9Bt3xUnWwgC89pT/r0N/DYjqHQ6p/UKqznLeCxwLEEJ/7w5:q4RVL8mfft3xUWwKHW6nKqznLMrJE
Threatray 566 similar samples on MalwareBazaar
TLSH 8573F76661D49D31E16AAFF13FF68156D46AFC220D93C40E24045A2E27B4F4AE7B073B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.44791.14012.10581.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Netwiredrc
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 07:46:49 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
02fbb8bf86f5163a9e3dcf6c172a709c2bd68fc9586b71c7c84627cc049da3ae
GuLoader
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
31e0d8d290cef40450e8afb88a58749155645f4f702bdec51a81290d0230de09
GuLoader
33b70dd4266c366a2d80bfacb2b1aafdafc74019b0e8a6aa480bd909e73f3a6e
GuLoader
4dc38cd2854259162ce68bb83f6ce11a755aa96aeba2134cdd18fd69720bece0
GuLoader
7fe7dd56e98505c9334f53d07e8c0b85b44c0cf9e89a1ae73df9b65b6aa9fdbf
GuLoader
900a6f47b5d63eeb95728c0ec9ae469d31564cfbb1849b34549ac0f8de28fcde
GuLoader
aebcacef83bf139cf1f922a1c8687449286d661908b9ffbdd7e51866ebde4409
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
fcce249643f7fe240695fdbc393b54a543fa4a49942b56ad8aad6f219c4f896d
GuLoader
+ 556 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-g9cy4d4acs/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 1e5ae0cad52869f12ca373c2e29ab46758f723060291f611fd6e1512ac0480aa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366869/
  
Delivery method
Distributed via web download

Comments