MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 343ff3ffa22f7bd8a4942c2d5ef3e9992bd47a383641f69eb1675bc8872db420. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 343ff3ffa22f7bd8a4942c2d5ef3e9992bd47a383641f69eb1675bc8872db420
SHA3-384 hash: 66d73c2c63c53c5b1435a63fc1c04cce26d8937a877a72d1463181fd43ca0c18c8178f481e32e4e42b0a58f2080331c9
SHA1 hash: 7c177a6a5f57a0bafdac07f60382bdbf5762ec13
MD5 hash: 0681784cf3023cfc5a6127da1c3dc82f
humanhash: cold-vermont-ohio-lithium
File name:fejlfunk.scr
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-22 06:46:31 UTC
Last seen:2020-05-22 08:03:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 86f4729ea3b9efe839b697b1c442184e (2 x GuLoader)
ssdeep 768:iFfDZ7NfsgdpBadsNCMqayJq0BkNXoK20mpNH6jpU1WFVfhaKZlEY:EDFNkgdpfxOJ7Ml2TpNHupU1Wnhl3
Threatray 281 similar samples on MalwareBazaar
TLSH 69930A2E759DDCA6D9054EF18F28CA6C01BFBC211E044B6F70C53BBE7532E92952136A
Reporter cocaman
Tags:GuLoader scr

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/4585/
Detection(s):
SecuriteInfo.com.Variant.Ursu.878098.5942.184.UNOFFICIAL
Create hunting rule

Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/361176
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:08:16 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
049a7c8bf4126088f12bcdbe2e1d5bbe5e341cfddda7959379c93a4036546200
GuLoader
066bdbaf5b5526cc3040573bea83da7a384e0c97df13d50a7cc0716b1dd8e6ac
GuLoader
72bc51445d960d638c96f46057b76b5200ed88009ef44d767e870e56d7c562aa
GuLoader
887de911a26e0008429adcba8abc212d36423fae62d40aa1df57e2883db77d45
GuLoader
8e3f5fd5bee4accb8b97a189288698796ef58595077f8598725f125c58b70485
GuLoader
af5562054a38fd1eef5465883393189cb1f862d6a52e85441f6efa638a8e119b
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
d5132d40838a12d557fdcea3492cbe6775330dc7298bb806b076011816fe1f36
GuLoader
fad5d998c52c536d0ee9053d7f6a1d7dd2bd11d3cc91af90992cc08a70bc33eb
GuLoader
ffe7e9077f89d196d10951c789e7c466ae0949c2bdb14c0b0d0e3755aee7029d
GuLoader
+ 271 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-t5t5rmtvbe/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

ace 998aee9b4b4ab37178dd79a10c7760697f06bf93272578fd9bf4a3b42123fd31

GuLoader

Executable exe 343ff3ffa22f7bd8a4942c2d5ef3e9992bd47a383641f69eb1675bc8872db420

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 998aee9b4b4ab37178dd79a10c7760697f06bf93272578fd9bf4a3b42123fd31
Cape
Cape
https://www.capesandbox.com/analysis/4585/
Cape
Cape
https://www.capesandbox.com/analysis/4518/

Comments