MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4eea887805fba70b1735a84c738063b750760ae338b509fa008e44160b425b94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4eea887805fba70b1735a84c738063b750760ae338b509fa008e44160b425b94
SHA3-384 hash: f3992026e9cbf29c80d0565b897b5ab4eec5e42509e0f663e989ae9c56689c315fda3573ee131e20a2fbde96ee4df8c8
SHA1 hash: ded47ebf16194337a585838f6a8a735302405fc0
MD5 hash: a3b3caafdd3ef07f6a844956060bbde8
humanhash: apart-triple-pluto-harry
File name:SecuriteInfo.com.Variant.Razy.676062.11635.4845
Download: download sample
Signature GuLoader
Create hunting rule
File size:77'824 bytes
First seen:2020-06-02 09:34:09 UTC
Last seen:2020-06-02 12:59:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9a0ff6d45e25a27ab2a49edfc67be605 (2 x GuLoader, 1 x Loki)
ssdeep 768:wqPXuc/MlIgQRCbcW97GHEDVZcpFliTavf2COBZlBJYY1W4H:VP+cAQRJGGyZccTHBfD
Threatray 778 similar samples on MalwareBazaar
TLSH DD733A5EBE489164F44A4AB119559063B739BC3254065E0FB3042EABEC76A83FCF173B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Lokibot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6021/
Detection(s):
SecuriteInfo.com.Variant.Razy.676062.11635.4845.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 04:48:57 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j3viq6af7otqwfzvvbghhaddw5ihmcxdhc2qt6qarzcbmc2cloka._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
32988d9efdef04149dafb7aad85acfc026b906452b1c6a11b5e8402157d20691
GuLoader
4af9eb9a627fd64924f12a6a972423e8c5a553108be81d0ee259ff4de7d638b2
GuLoader
5344451622e4d4ac6036cdacefa0e5299843a2aee428cd643bcc663630b3b3de
GuLoader
6d043b33b33e6baaf7514b9ca56f8dbd8aa57bc71a9040bf438bc780c1a4ad5f
GuLoader
748970d868ca12ef96a98cad33b9f3c7bf7ab20ce2e595d4fdaab152e50b29c8
GuLoader
8255284fa792c767fd2464364f12f297fa92a38383d2303d7cf9dcb8b74bdfa5
GuLoader
8db887fade310b044bf413542735e42ea639ba015a1442c1efaac57f6c37628b
GuLoader
95b7bbca4d924be150fb6858b8546d3386d44a8a589a7a60ab1a0961718ee84d
GuLoader
a0ef6565b8fed20e76a7fc22c4627c0a62b6d5bdc3b79b7901a00e236060ee2b
GuLoader
d99947df7b80d4cf1f998cd4c205df67be0afc6ab0d9b4d92988b1aeccc1bf0c
GuLoader
+ 768 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-2e41y5ncx6/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 4eea887805fba70b1735a84c738063b750760ae338b509fa008e44160b425b94

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/373707/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/6021/

Comments