MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40329aa70c46a8447073674eefc1bdcb43103f359e57c6d62b30ba947e67ec60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40329aa70c46a8447073674eefc1bdcb43103f359e57c6d62b30ba947e67ec60
SHA3-384 hash: 85c59b976d4805ace2ae1449b9a8f82e990c056f397ee6cdbe2fe7c01989dfdd67e741d8850a50e0a1a68aeeb07d8286
SHA1 hash: 5e5a28e43990f77b4f51c1e6d26e9c88c168e790
MD5 hash: f6bc9bf85e6406c7680be860b9d80911
humanhash: utah-king-magnesium-nuts
File name:SecuriteInfo.com.Variant.Razy.667167.31467.2918
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-06 14:11:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d68a5163946a6a10ced3cb8145c9e0ab (1 x GuLoader)
ssdeep 1536:AfoJCJyLQmD87xyu+V2FtVtI1xfBVsy/1/:Xcazd/
Threatray 244 similar samples on MalwareBazaar
TLSH 9393D512AEB0ED22C91076B1EBA9FB5FC355AC3414314907A5C53B6E2F36A829D3135F
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.667167.31467.2918.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 18:44:54 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
33a76af55237d9ba192ee8496fd6c4adc489593705e81c663a890b39e1c92a8e
GuLoader
466d70c9b3829d49bc3f4c4dbd5a3b0191972a2dc2daaea0f7876e43ecaf5aab
GuLoader
5c72319951ad91b63b91ca0ec9b5ff7009e6b7ceec18d8c4cfcb12758715b7c2
GuLoader
68313d4b45cc908f541dd581d7b9d1e8ccadcbf205714c12c36b58083ada7345
GuLoader
7a3cdb575c0821cb1a8c492105fb674999f7fb0674007b669ef837a77335e447
GuLoader
7af7b083ccaf83c1b1b4c7083b4c121472846f1b7343a0a83c883a8561fc62dc
GuLoader
8855ead65a2c190dd8dcf1c1fd3998042bb51cf01df8c3d3669d2f0d213a8337
GuLoader
af665b25b8506408fc9764859ec6bc30b9560d484280d8d115e3e06d4bb973d1
GuLoader
bba8e751eb860c74e5ba37ff5a3e24bdf0ba1cb2da675593f3009eec27016a2b
GuLoader
fe271b4266e4d1da6cd411a99f35ef14bba6e93354d43f4b790008d9222e0ba7
GuLoader
+ 234 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-egzm3wrkrn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 40329aa70c46a8447073674eefc1bdcb43103f359e57c6d62b30ba947e67ec60

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/358771/
  
Delivery method
Distributed via web download

Comments