MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33b70dd4266c366a2d80bfacb2b1aafdafc74019b0e8a6aa480bd909e73f3a6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33b70dd4266c366a2d80bfacb2b1aafdafc74019b0e8a6aa480bd909e73f3a6e
SHA3-384 hash: f8f70aeeece5851618dd5aa491f8071e265f623d75fd3b6c50c3ae7e3782a92f39e0a65280837fe169800683a2384c64
SHA1 hash: 8abd1d942191954a0558dde5a1e4d634c28a7ff2
MD5 hash: 7840a7dd12263752fff01c1a6907e918
humanhash: football-vegan-ink-carbon
File name:SecuriteInfo.com.CLASSIC.26866
Download: download sample
Signature GuLoader
Create hunting rule
File size:126'976 bytes
First seen:2020-05-09 14:51:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 017af5937604d95199b74591ef9ec3d6 (1 x GuLoader)
ssdeep 768:5cOtqi9wUSR07x6Tt+weWVAfURjOfioo2pBeXu5QRWf/mIesoonBqJmGHs/suCRz:OYV9GR07sLFsVHf+IBhhGHQkOG0o3F
Threatray 296 similar samples on MalwareBazaar
TLSH C4C3182AB5D0A247C32586F02F259BB845ADFC3064698D03E5C1BA5D1777FC2E22276B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

SecuriteInfo.com.CLASSIC.26866.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-09 12:25:01 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
15145ed8e5ae3cf2acf9ad25bbcb3f782c4d8ba9674185d06baa66ae6d17f25a
GuLoader
1553300557f17e7cb62c914616267bc733854b98a0edc5215d901cc4f8e4d0f0
GuLoader
1a3223bf578249a17b6d1f8ee0ed8a5fd49690621f3ea63d0380db03f2c31e50
GuLoader
1d117728ec260d80f6c6a347c4c32c965c69ff10bd4f08444fc70e82eebb1094
GuLoader
4100f196d5289b085ea167afbec9aadbb5105bf46e48b5402f583db123878f96
GuLoader
610ef8befe605dd4ba3277c221c25932ffd6e1b939728da70ebd0d1b96fddaa4
GuLoader
7294bdc3333d08ac9c2397b3555c0126928c13600b23de09f21841cfee83f55a
GuLoader
7a445143a652f58fa4abc4957269aea8f884f71e7f4654b56385491eb544b0a5
GuLoader
d725785ec3970b75ecb17a7e5ac14d93ce7a54d259dffc74e8222ed8cfb8b6b3
GuLoader
daac1aafd4f0f7b1e1e0112e913285543d73179216bc42cdf67036dae67955f0
GuLoader
+ 286 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-7qflee7l9x/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 33b70dd4266c366a2d80bfacb2b1aafdafc74019b0e8a6aa480bd909e73f3a6e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/360441/
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
Delivery method
Distributed via web download

Comments