MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26f2158d9837aa986e3d69b6cb3df0ea039d0434cd504c2911ad9788bbbf7715. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26f2158d9837aa986e3d69b6cb3df0ea039d0434cd504c2911ad9788bbbf7715
SHA3-384 hash: 7b2e01eba4319e7ae1d408f7f997eea9a180d5fefb8a36887adf69f8772687a0731a6b96d1fee133b32c7e7563ba4c04
SHA1 hash: a8d3f753f1814aa25650bad48201974a39789084
MD5 hash: 494c83a0e2222ecde9c20e7d8b70e07f
humanhash: speaker-hydrogen-green-sierra
File name:494c83a0e2222ecde9c20e7d8b70e07f.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:53'248 bytes
First seen:2020-05-28 13:52:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d36a502c4dfb9e1fef0b30466a240f25 (1 x GuLoader)
ssdeep 768:FJ+8f3b26z8f3/jQNXbd2g+5Ab9EJhCiTc7Dctqygnab:FPf3bzVZKA0hCS8DYqyz
Threatray 784 similar samples on MalwareBazaar
TLSH 86335B27FE5442B2F16A46B12EA1D9557D3B7C321901AD0B7A80FE5C1D31883B9B272F
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://45.143.222.30/Frank%20May%202020_PDyqE221.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5875/
Gathering data
Threat name:
Win32.Trojan.Nanobot
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 14:35:59 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
06361c9a89aa0c9e8f8ab725d30727dbec414b31c3c0b334f8cb9aa9ff890eae
GuLoader
182b2d026edb387534dda66711ee6f9050bc8ed871d0ebb71a96f0b18498ba24
GuLoader
1b4e008beb2b395e53648c9a246ecafcb3df0543c5236a40cdb976a2007bbf97
GuLoader
35787807345e104b2fc93883c3d54925d876b4c6a03153110acd9cf86f655459
GuLoader
4bbbdca53bbe4ce27fc929968933f482e17a3161abaf8d7bc06cc06b5a5d1b7b
GuLoader
586308277bf0f934777f113da1b684233d2cdfbf6b746eebc35d2f8dc8d1c585
GuLoader
6591794758496511c22b638fc57b5d58943670a72568dfa92f29a08c501c73d6
GuLoader
ac839669e7e0d6b42bf9517cc6f4db88c9eacc678df15c1c45be1771309cb020
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
c689edeb2bea45f5a7e6402ba51dc23e40e6c8b509841f60cb3d7327340b9b60
GuLoader
+ 774 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-qk6qvh51sa/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 26f2158d9837aa986e3d69b6cb3df0ea039d0434cd504c2911ad9788bbbf7715

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366578/
  
URLhaus
https://urlhaus.abuse.ch/url/366577/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/5875/

Comments