MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2eaa7ad1f155047a8b2dbdcc1fd84937172708f7e15e3b1d2846cba6647464ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2eaa7ad1f155047a8b2dbdcc1fd84937172708f7e15e3b1d2846cba6647464ce
SHA3-384 hash: 1992e0597e3646fe137475374617c7ac3e898a1c08f2829804ab6be91cead41f545871dda886afc8032aaef92bdd20e6
SHA1 hash: 91f9f7a6401ee8c01cf93d2fdcda8d2c1bd456f4
MD5 hash: e590740caff17d38164a3bd10aacdd46
humanhash: william-jupiter-green-river
File name:SecuriteInfo.com.Win32.GenKryptik.EJUR.17488
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2020-05-04 08:01:29 UTC
Last seen:2020-05-04 14:57:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3a939f7b2117be0dc3bf4135bf092c18 (1 x GuLoader)
ssdeep 1536:p7bd11PaHOjCuE6kSfrZ/21S4I7tCLpJ566O7Co/24H6nom7va:p7bdzagvEqTln4qYda
Threatray 104 similar samples on MalwareBazaar
TLSH 9BA3F891F7D4900BFA6559B25BA9D3E44062BC395C861A037AC4332E7A32E45FB9133F
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/2754/
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EJUR.17488.UNOFFICIAL
Create hunting rule

Win.Malware.Generic-7751004-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dynamer
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 04:44:13 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 30 (80.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0e2ff65bf3e2ccdf8a5c94830b0c8b72ce136d017f47bc14933ade45b9bbaeea
GuLoader
10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821
GuLoader
14bd280177ece118d671795a8b372a0d7de0f3ad3b842ed35726d9b587cb1608
GuLoader
40950dcb88e56bcea0e542f297d60fe5a96d410473ec3fe51e9234b40304d329
GuLoader
473f59e503b660f8b9cd8f4a36f955f59cc9b0ee19dec2570d9a907c22df1907
GuLoader
486db57368974cf567fd3a1ae1f5800519129d0aa1f0946f27f7b85da4f3a5f3
GuLoader
9028aeddf4c76b16753ea37720bae4088308671214e6cf192705622cf07d41e5
GuLoader
9059531fbff89a14fc3761330cac92437bee44349e6b62e7e807422b4c57e2fe
GuLoader
eaf38de6ac4347ac84bcbe648301fedfe021aeafbc3bf40404a4003117a8967a
GuLoader
f573cf3eed6dc5635fd82f657a0912c151e2762188e71d161bf173bd40abaa3d
GuLoader
+ 94 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-3gbf37jexe/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 2eaa7ad1f155047a8b2dbdcc1fd84937172708f7e15e3b1d2846cba6647464ce

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/356737/
  
URLhaus
https://urlhaus.abuse.ch/url/356756/
  
URLhaus
https://urlhaus.abuse.ch/url/357032/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/2754/
Cape
Cape
https://www.capesandbox.com/analysis/2753/

Comments