MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29343bfdec500d3806edf49730da22199c42573b3ae2b8e0e3534c7687c93b86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29343bfdec500d3806edf49730da22199c42573b3ae2b8e0e3534c7687c93b86
SHA3-384 hash: 75e7b0a05085b578a25e2ee6d58e985c66b1978b096d76b59f74764e106f27f8a8170e9c213bb9601fa78fed34d6b50d
SHA1 hash: 4ea33caf0214e73f3b0e46ca78f3188f1a2ae28c
MD5 hash: b7085b8fd3d6a82c6b45ffa6b0aec2d9
humanhash: gee-happy-delta-lima
File name:b7085b8fd3d6a82c6b45ffa6b0aec2d9.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-22 10:26:33 UTC
Last seen:2020-05-22 11:46:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f6e1b555757006a1848334d2bcba3395 (1 x GuLoader)
ssdeep 768:kztoZWj42N4OEqb2NpLDtdfxtMcbx/dJ0pOxOnwYu8dkbr5XmVqXfE:stoIfbCFnfxtMSoHuRRmVz
Threatray 296 similar samples on MalwareBazaar
TLSH 82931966B980D8B2CE704FF15D3285B82867AC711D514A0775CF3E1E6A37A4D98393CB
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://1filesharing.ga/cryptd/1FilesSharingLoky4_QDjLijOZ113.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 10:36:47 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
013272a7f6fd9926e268e175cfeb2bcb0aeab1573a68693c872a119bfdfa4402
GuLoader
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
443bc33e9d28fddd4229367cde23085b8d57549093ce8e991eb4753ce58c85fe
GuLoader
76539c09f989d3cc938d6984f9ee8b6680fe2416822d63bf53a1712aaf9b695f
GuLoader
7eb79aa85e80bebf0a52217d26985acb5ff2f594e9f3e0b07e210d7963c2dd4b
GuLoader
8c57c150d120c496a04aaad020b5458e8eff5f3fd69704a581360c785288c8d0
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
dda25996ab5b78fa63ab71aa304360374fe2eb6ded670c778b2c69d9fa1f1e40
GuLoader
ef8f03a25087eeab581d8439a0a19ba7148270d2210d479c1d6867fac69dc813
GuLoader
+ 286 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-bagn1bnpwa/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 29343bfdec500d3806edf49730da22199c42573b3ae2b8e0e3534c7687c93b86

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366535/
  
URLhaus
https://urlhaus.abuse.ch/url/366117/
  
Delivery method
Distributed via web download

Comments