MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ea315e9248f2e83decd8b9a73335ce654e787c42083c6e21566cd9bc2f93eed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ea315e9248f2e83decd8b9a73335ce654e787c42083c6e21566cd9bc2f93eed
SHA3-384 hash: 89d00e01af7442545be25364c1257f9fe97395fed6abbf6aa12d4ae48eb4fadb362caf847534812d38ce219af1eca5f1
SHA1 hash: 67709c8080a82ee458950c316ca5c1e36dd91308
MD5 hash: a791a18accc93d72c08066da4d73410c
humanhash: five-wisconsin-lemon-sodium
File name:TSD68900C.scr.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:184'320 bytes
First seen:2020-05-18 14:40:08 UTC
Last seen:2020-05-18 16:10:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 60e20c66de951f60d209abdedc03e928 (1 x GuLoader)
ssdeep 3072:Kv3BGg3HH5SFAGAxrZlY1Fg95FAZyyS1nw:KZGwn5xlx2g9syy
Threatray 525 similar samples on MalwareBazaar
TLSH 4B045B62F5D4AA42D6218D3E8FE6C6798117BCB44E10C907718A3F5F36F3A46A632317
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Graftor.751753.29961.18949.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 08:47:12 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 30 (73.33%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
51d91d2e7e9aeee2a291dc1f7eadd9e422d159aef4cf902ef9038d951527636f
GuLoader
6acaee10404d0683e19ba29cea5234766cbd37253c44ade9cc1ca557c3995f3a
GuLoader
89e35356978b8320736b890db74c9f70f4ab89dc7343bbdfb9cd80530dd4df32
GuLoader
9b2ad325e0cda26d0cd3769bea307050581d5c38d40d1281ff7e6b56420369cd
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
d28f7e29c76ea32e8a690122a4d729408136d83a70ac491231b7458c740c86a5
GuLoader
ef8f03a25087eeab581d8439a0a19ba7148270d2210d479c1d6867fac69dc813
GuLoader
+ 515 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-nw1zf36qna/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments