MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b5e08d727e3e43db31db4f514737a9ac90088bb581df44beb9c0ca2c0d9bb07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b5e08d727e3e43db31db4f514737a9ac90088bb581df44beb9c0ca2c0d9bb07
SHA3-384 hash: 160155ccbb6fb8a9eaed87f88a2a7c7b12f0c6c65924eda19ff6e0a9ce0542cebe208b749e1f53bde3d01de134753362
SHA1 hash: 1086083abbace705ee21b0a704a536769319f50e
MD5 hash: bb6fa334c53dda3106b77c81e56bbff4
humanhash: sweet-item-ack-london
File name:bb6fa334c53dda3106b77c81e56bbff4.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-21 08:35:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d549adbc1dc2241211d8c8b103352fc (1 x GuLoader)
ssdeep 768:m8W1+yuooENdbSAPQFDjwsgUCm3xssB3UCbiEAnpIqDpvp4tbD2QhG:4OvGdwwsgLm3xNBtY
Threatray 142 similar samples on MalwareBazaar
TLSH 0B933B12B5944436E3504A71DB69CBE8195BFD202A534CAB3E847B9D1B3F649B22333B
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://learnteachweb.ru/ikt/filter/algebra/tests/test/d_hTRcNwhoO16.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-7788440-0
Create hunting rule

Win.Trojan.Generic-7789322-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 08:07:19 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnparvzh4psd3my5wt2ri432tleqbcf3lao7is7ltqgkfqgzxmdq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0e29e2d1a0dcaf0555bab1cbe36992a89271f4cd16cdba3d3e1f4d79e9e54fc2
GuLoader
1bd1ca91461e6bc1297bec8ebc99e516b55f2cfb3feeb3df2ccb6f0376afce57
GuLoader
8299fb84b56afeccbd7542f9c33d66fc40f5ab48fe5076479dd66c24f5d19fa0
GuLoader
8f8ff17b512710722ead6b14aa0f6978b88bf62efb4e61db7c9b589c6f5ba7b8
GuLoader
ad64a6eaa5d2494a4161158792e7cde3fb7d9a7bd36f06cc0de271192582f439
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
c97b1735ac5cb99698e1b422244a6b7b0041ff9acc25eb945ff55ebb317b06c7
GuLoader
d252bafdd21ef871df2eeed20ae4cbf3b6e2f6df268d93ea563b01aaec889baa
GuLoader
e943534d22e73e0d062b7917c007b744ce19014e0a0c90dfd37219281bcf204b
GuLoader
fbb7024e3cb635d49b69e56354fd69915a4b2a2e57f03bba818958d2aee5d46c
GuLoader
+ 132 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-2d75z435hx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 4b5e08d727e3e43db31db4f514737a9ac90088bb581df44beb9c0ca2c0d9bb07

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/365916/
  
URLhaus
https://urlhaus.abuse.ch/url/365926/
  
Delivery method
Distributed via web download

Comments