MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b030ba8e4ea2927f995762c1063a0d50d285842856ea1bd931bbfb61c59f617. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b030ba8e4ea2927f995762c1063a0d50d285842856ea1bd931bbfb61c59f617
SHA3-384 hash: 4fc889b635a85983916599ebc068b4137ed890791caa2b4e80c29bad604a5fde4732a7d6150aad3aaf9c92e4d0d65f0b
SHA1 hash: 040bc64833b28d339b2147ce462c2ec3a6d29008
MD5 hash: 7de48479d5c66504eee1ad2284950070
humanhash: venus-december-six-charlie
File name:7de48479d5c66504eee1ad2284950070.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-06-02 16:01:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4bb40864a31b215b430750c60010708e (3 x GuLoader)
ssdeep 1536:npFO8lLyFTRKY6UB87lOLzwKQwjmrAfEKtA:+6UYlwzwPCq
Threatray 951 similar samples on MalwareBazaar
TLSH 5093F8037BD49501F1B24A712EBB92996F26BC1A49838A4F744C5E4B7B317629C6C33F
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1dSPbSUamfyS9G1y8dgXbR45ZkUnEXz6I

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/6163/
Detection(s):
Win.Dropper.Nanocore-7995247-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 11:42:59 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmbqxkhe5iusp6mvoywbay5a2ugsqwccqvxkdpmtdo73mhcz6ylq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
17653f0b95df006bc5833a71a7cedaf0210ab2dd9c913104576b4823c8f7cdfd
GuLoader
290452bb8eb4dfcc3cfb1590c8fb1b44427a3c9f0439ad5855e35bc39537a3a3
GuLoader
2c80f61e5c61bb87be9e2d60e69093bcb5082fc690fcd751be787dbd118d5e57
GuLoader
72eb2dc730e3574dcb204d37fcfb35cf91bacd8087d6028d743cb0992c874244
GuLoader
8c4a0f5a5739f570edea6dcbb7d5701cc6467ccdf00554a88669aab0f743180e
GuLoader
96ffe97ffd555e8f1329ba24b40cba5320d5bc1ef51fb0155b9dea55bf842487
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
cc2739cc340e54819e37849b37727727b422a2567ab39f541108394dbe8fd98f
GuLoader
cec2f9996977f945ffbdd5624170b6e1daa151aaab1e5d9aea7a5566f5197dde
GuLoader
ef524b7b95bd6abb42e477395a29c1b848b6af42164fbe21b422ea0a8b8e367e
GuLoader
+ 941 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-4bgwv23rga/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/url/374620/
Cape
Cape
https://www.capesandbox.com/analysis/6163/

Comments