MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39c6542eed54111b41269af0a620177cdd956144f35e97be9f6814d6b653bd25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39c6542eed54111b41269af0a620177cdd956144f35e97be9f6814d6b653bd25
SHA3-384 hash: eaaf77c543a824511de930a7bc650242db99a1b2606339567b18cb64e4760054345fbfd62b3d0cf3772d0342813b308a
SHA1 hash: b631062aab66ea18b218c0701902b0d0a1e4f178
MD5 hash: 0217d6a9a71f29254031e09869fa4b05
humanhash: early-timing-utah-fix
File name:SecuriteInfo.com.Fareit-FTA0217D6A9A71F.32544
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'016 bytes
First seen:2020-05-08 20:58:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 717c57e789a92e2e090255b6053e0ae3 (1 x GuLoader)
ssdeep 768:XGW6m8Tme514NdtopHEaqWX2nqbvNIyh0sx:XGxqe5cOPiqb1IyPx
Threatray 346 similar samples on MalwareBazaar
TLSH 3C832A1876D8E333D3549AB15EA28598002EFD7819025E0BBE853B2D2F3DE53D464B2F
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

SecuriteInfo.com.Fareit-FTA0217D6A9A71F.32544.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 19:58:37 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
25db81a9c27d2c56fb1d168f3416260ae33470a32e8adb3ff15a0b30e43abc6d
GuLoader
34fc69d9d5119015a1f946f18069d1464c45e02b5716b91ae2c99eb493ef7242
GuLoader
40503a4df817599fdf0125c5b99076700718e3eb50bbb759d139aa95a8d18d59
GuLoader
4cffbdf1d3e2016475da67b15f0ab12a9658e0970f691cebe0bd161e2e1772b2
GuLoader
4fa4af45c70295513c486589c0e36e7436be6abbf3c75e97b544db959e9dfcb5
GuLoader
55a6b731215e8aea38a6f556669290c120ab916ac57754e45aca7b28b6cb0b9a
GuLoader
b5279796301bec9d8b3de84dff29a98dfb7cfe9d549279fddfd624b61583960f
GuLoader
c72cde3224e01da2283065c5a94d252f528c132019eb2f2656c86a7caa1006c2
GuLoader
da103e7998ff3ffd61f85d819dc90514d910c30a0d2e9ee6c071001f9137161a
GuLoader
e334369d4dffb0045792f6a45b6636c014d3e9624f41f1266b415256b17e4099
GuLoader
+ 336 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-z2rrythr7e/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 39c6542eed54111b41269af0a620177cdd956144f35e97be9f6814d6b653bd25

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/360038/
  
Delivery method
Distributed via web download

Comments