MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28bc3b4c5753cac3f577d73f2cdcd3066fb44597cee5d25603519251af8ca3b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28bc3b4c5753cac3f577d73f2cdcd3066fb44597cee5d25603519251af8ca3b2
SHA3-384 hash: e439ad613d4a4c5a8d07cd8b36b64e517e6928e4afebf49cc079fd57c56cb8937e26c6c6721945d569b63e409cff92c9
SHA1 hash: 3a0b25206e8f03cb4117d3afa694ce811b3e1eda
MD5 hash: 9abe63d29c9e47eabf52ef7837756403
humanhash: video-freddie-oranges-oklahoma
File name:SecuriteInfo.com.Variant.Razy.667447.31025.9080
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-07 08:44:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7902a3bb8ffd9361c9909022cc92d2d2 (1 x GuLoader)
ssdeep 768:E7bQQ/qENvo27nrJsOVL1PGkiU8mbqEvIFb61Nl6iUgm6gYhjQBmvbE3cO:ohL1o27nrC8Oo8mbvwFb6V6iw+jd4
Threatray 72 similar samples on MalwareBazaar
TLSH 7F9307407EB1DD22D1007AB4EB65FA9ED356AC311932890B65C43A1F2F39A079E7139F
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.667447.31025.9080.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 03:27:50 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1ddf5996d1eaa42b6c617802faffacb02a374dadb9b303dcdd11d135e2e8a288
GuLoader
268953af63bad4895dd06c024fd1ec2af2c134623a0e100e26894e4d6bab741e
GuLoader
42ecc2b3aad37d4d989281694245818a2e1ae209a2408dc36e359f09687de43b
GuLoader
6269fd417f93e7c0d7cab576b35dc3b6f6a58c0f04e75533bad84987c228f0e6
GuLoader
71fbde841f1552f738e048f3a32204026a9ad1392109c20124001d6658170c1d
GuLoader
75fa551eec71d6d8b9817266813715c2bbb7a537005587f9f1e0d058a05febc6
GuLoader
a4e4a2a189dda373ddf77fed73978b52a064363251f86b53d462b3ef4bac7b7f
GuLoader
cbf132a151298c2ffc66d0bb6969ca878f8c3eeca1f17dbabe854c3b343b8e11
GuLoader
dd57430d1f109d9a87f2959eea95f3162418c176cb7ca9878a64a4a879a2820c
GuLoader
e7d2deba4fccbea79ffa209ebe0ce49f98aecfb340c8d6ec3ea1773cb12cb07e
GuLoader
+ 62 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-pfvftbzhs2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 28bc3b4c5753cac3f577d73f2cdcd3066fb44597cee5d25603519251af8ca3b2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/359350/
  
Delivery method
Distributed via web download

Comments