MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b7498abb82bfc105fb641bc1b9e9da602bfeefb252dd8d16d7c1e4fbc3a4668. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b7498abb82bfc105fb641bc1b9e9da602bfeefb252dd8d16d7c1e4fbc3a4668
SHA3-384 hash: f5166245f2ab10f8d7e48ec7c4b3500dc3ef72e45612fac38f79a484bccc68ee61200dffdd822c450d73e023a0a41c05
SHA1 hash: 6b7520a7354236de501c72f11970f42828ea0b08
MD5 hash: a7ec5e4d0772a2f29f0c78d4cd93510a
humanhash: beer-oxygen-oven-uranus
File name:ORDER.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2020-04-10 19:03:13 UTC
Last seen:2020-04-10 19:31:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 326a61fb64380601a7f6cd2502512aaf (1 x GuLoader)
ssdeep 768:8hPoJ5nvj81IY4R8RJ30x8zv+wtiEuQud8uLIgOgTYJpFOnsEU7Y:prvY1p4Ri0mzv+wtiEuKuLIgOg8DOn/
Threatray 722 similar samples on MalwareBazaar
TLSH 74A3B4637980FE68C0194AB59AF1C2BC1060BD30DD84660778C53F5F79B8AD2BA52F97
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.VBGeneric-7665724-0
Create hunting rule

Win.Downloader.Minix-7665742-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Minix
Create hunting rule
Status:
Malicious
First seen:
2020-04-09 18:10:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fn2jrk5yfp6bax5wig6bxhu5uybl73x3euw5rulnpqpe7pb2izua._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
06c39fdd95aed534806896a460c1cd568259e7b786b20abd7e923c4d1d4d8511
GuLoader
2ea5a4fb25528051254f255dc64913ca7d4faa1ecba2f40a55b536f871624fb9
GuLoader
504cd8dcf16b6e6b55271ef9bcd8603916ec5f81fdeb0615e3c970954d50a7f0
GuLoader
67aa5b86db90b286266d57324824825453a9db72b15414ee064dbf01085d00b4
GuLoader
814cf0cf90c5b99f4bf827ca64e5c7c55d73e036b9e8646f0d6031444a90fe63
GuLoader
818a7b0f2761340c423a9feabe5aae7fbf96129316ae4b0a11357cbaed344bbf
GuLoader
a3c9b063a2e0b2543b34146f01d970f5ea721fac3fccc95bf1afdac5a56164e9
GuLoader
bb2faadcbc0d7c66a84bb763e34cc811194f21a2222541a62fd1c0d9d3ce6c42
GuLoader
c882cc422e4039600b31e53e369f05b29dc9dd38cab76facef8a42adc8d326b3
GuLoader
ddf6f04276c1d976e62e199e6c928fb7a3d7aaec455a1859f8d8f605c89ffc64
GuLoader
+ 712 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef

Comments