MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8
SHA3-384 hash: b6b14195b430d21bd18dfb14b41acea79b173ef668047fb7342201685ab793b524983f980a47ee46148e88df8fe3fa07
SHA1 hash: c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd
MD5 hash: d2e2c65fc9098a1c6a4c00f9036aa095
humanhash: triple-delta-lima-lithium
File name:d2e2c65fc9098a1c6a4c00f9036aa095.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-05-30 09:26:09 UTC
Last seen:2020-05-30 10:53:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6a38de66ed1038b4600aca30e494f049 (1 x GuLoader)
ssdeep 768:IPqTXu0Ee0J9PL8Ln0Rq4YK7NqqhGiZRYPPCI/YzHC2munTDWXQeYJurR:9T+0wH8Lnej597Yhw5TDWXQ3u
Threatray 816 similar samples on MalwareBazaar
TLSH 7F533E2B7E459112E1421A302C64D556BF36BC335806AE1BB6C4AF2DE83148BF9F132F
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1ELoiNSVTziaBatbVNZQWxal_RsriCCrt
http://ffacscs.ug/nw_kUILGeMGK73.bin
http://blockchains.pk/nw_kUILGeMGK73.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5485/
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.50663.21464.6740.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 19:06:08 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0c80fa8807477cff8c9c3ed7b2a857538f022b1e8829020d09f60bd71f1afd9a
GuLoader
1e04c1e4eefe23f454553364e757209462f2561d8455628b296b1dbe83fc6ec2
GuLoader
3ee04e378f6430e85f5756093e80b243c2ebbcb9f2ee77cc32acd1cd9e333301
GuLoader
60544c6694620488b69e568b15c96b33971dd7343ba63da31f993332852871c2
GuLoader
6535df8dcbd659939c18a93ee2b58e8ef05898e1baa30932cf3cfa876659d183
GuLoader
81a9eb444ffc7c5a700d4da6198c2f929d0e312d38667b9d3e29740eccabca3f
GuLoader
8d5a770975e52ce1048534372207336f6cc657b43887daa49994e63e8d7f6ce1
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
e3bcf059f0ad7b1c92462646e135623d3ce75addcd6a0d207b78e2fbfb6dac2d
GuLoader
e5b440a826d14744df920514f027f0871f84292d83b95b731eadfe3165117448
GuLoader
+ 806 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-deqs26h2tn/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/372429/
  
URLhaus
https://urlhaus.abuse.ch/url/371185/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/5485/

Comments