MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32573a86c1eee729f2cf29f8e948c6b8d33b7d66b8976862d268c0e3413ef2fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	32573a86c1eee729f2cf29f8e948c6b8d33b7d66b8976862d268c0e3413ef2fb
SHA3-384 hash:	98128a1fd119a94d3a5231bd60d5f4291c6809c4796beaccef4c42a4baa624c2440f70a07685fa48224e8691a5984656
SHA1 hash:	41a8ee432827d52c6af74fc9039a36889af7b354
MD5 hash:	6e798fe1066db3e6ba95a6dcce788608
humanhash:	east-diet-summer-violet
File name:	new order.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	110'592 bytes
First seen:	2020-05-05 07:49:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	183f31bfa30423646aea87baef9a5551 (1 x GuLoader)
ssdeep	1536:nJ1PD8OR+xGIXWUts2E8Jh1J9ZuDhDuxS5Ia2Ic8PCHAUWB:nJBD8S+xGIW8JDJ9ZuDhDuxZ+csCpWB
Threatray	107 similar samples on MalwareBazaar
TLSH	59B342405AE6FD1AD8A939F2C725F09DCB906C35A871721BABC0715E1F399809F3076B
Reporter	abuse_ch
Tags:	exe GuLoader Loki

abuse_ch

Malspam distributing GuLoader:

HELO: pleskl36.axarnet.es
Sending IP: 91.142.210.104
From: Catherine Minio<c.mini@blancmariclo.com>
Reply-To: <c.mini@blancmariclo.com>
Subject: Quotation for new order
Attachment: new order.rar (contains "new order.exe")

GuLoader pushing Loki

Loki payload URL:
http://castmart.ga/~zadmin/xcloud/gold_TtBaWDj152.bin

Loki C2:
http://allenservice.ga/~zadmin/lmark/gld/link.php

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Siggen9.44407.26002.3124.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-05 09:25:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gjltvbwb53tst4wpfh4ossggxdjtw7lgxclwqywsndaogqj66l5q._file

Verdict:

malicious

Label(s):

guloader

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-lt1x2q6rnx/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks QEMU agent state file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com