MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 409b5df63705aabc1454bfe5a37b511cb6b38e10876fa39fe2609bc05d8ac169. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 409b5df63705aabc1454bfe5a37b511cb6b38e10876fa39fe2609bc05d8ac169
SHA3-384 hash: b500d4cbc6f9cc7e5260bd7f1a02bbd952812ff8b7bd60b59cef5378bc07de23210126a46d5ab17410bf75a225777b14
SHA1 hash: 8837395db4b30fbe210c00aa354a12a75f6dcd57
MD5 hash: 5072349194915b621283887f526567de
humanhash: glucose-mobile-freddie-oranges
File name:SecuriteInfo.com.Backdoor.Win32.Androm.C4041802.22436
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-08 22:51:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1bee78657ff706af8c1c26d7b55de9b0 (1 x GuLoader)
ssdeep 1536:8XRqzS35/ViA7kK93ot3Nzhm96esgwOs2r:0/z7Z93ot3Nlc
Threatray 777 similar samples on MalwareBazaar
TLSH 3C93B68163E4D027D5AC0AB26FA0D298A354BC36AD06EA077BC1775B1D348D6E360B77
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

SecuriteInfo.com.Backdoor.Win32.Androm.C4041802.22436.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 23:35:19 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
154e3d61c42499996c63db646175ed1b3252c598d7e79e7e03763f99ebb23294
GuLoader
222e404e018c17e02a05cdf15699992894593b76b1372ec300981ddb38228cde
GuLoader
34d5bd380c2902b64435c9e3cb3a917b329cdbde53397cac6ec767af3904b2f6
GuLoader
37c825ae11473b79ef176cd9bb749201860e47d02ec7b239e4e65db3a2d9ade7
GuLoader
96e695effa7be570f49f665ad01907c413443b0f51fdbec6372d2ff7c9861d72
GuLoader
b32582d965c3013be019bba8cb16e651c11b5a59876d3c62403569a0127782b8
GuLoader
bbf1cebce86dde95f8a66414a1106ae2494b57c7b3d36d6df16b8ddef74e6346
GuLoader
c0b283bef04917f527c9d2ccc9f4f9c20a9a91651adb2d2ee250901d66ff53f0
GuLoader
c60f1b4267812d2650795dbc1df35f5bd590bcd24253a7fcb580e7c961b9523b
GuLoader
dd106cd0751eee604ab0bf2e0a5b89fd86a872aaf2b707161cd753d316652ffc
GuLoader
+ 767 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-a2xf8tfz32/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 409b5df63705aabc1454bfe5a37b511cb6b38e10876fa39fe2609bc05d8ac169

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/360038/
  
Delivery method
Distributed via web download

Comments