MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f72bf95216665e7d33e013a73c7ec71cdc9c221ad45f25ec74d20c1a06b8291. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f72bf95216665e7d33e013a73c7ec71cdc9c221ad45f25ec74d20c1a06b8291
SHA3-384 hash: fb92ffc02ae2cb67c6e6523fdcfbf58ff6a520a53c96e8d3afbd84ab2b09719ba6910aeebd125bf5d5403060a8db6695
SHA1 hash: c51f424298d67483505aee34fae2908563767672
MD5 hash: d515925894756fe76104b27a7a0e14f1
humanhash: spring-zulu-oklahoma-princess
File name:order(MAY).exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-05-05 10:50:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 69998c3357d455c8b76af99880435d8d (1 x GuLoader)
ssdeep 1536:wKd/ZjUETwcdzqPOtY7bGhJl5Mjh8U3uV8D62lXgPCHAUnW:7JZwOYbG/l5Mjh8U32GDXoCpnW
Threatray 219 similar samples on MalwareBazaar
TLSH F6B334445AD6FC1AE8A93AF1D735F09DCB806C35A875721BBAC1710E1B398909F3076B
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
GuLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/3136/
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44396.26322.917.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 09:26:14 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0a6caea4ce7bf55029e1f01895a6c653fb2c5166f76dafcf94956dd8915e4eab
GuLoader
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
1e123a6c5d65084ca6ea78a26ec4bebcfc4800642fec480d1ceeafb1cacaaa83
GuLoader
443bc33e9d28fddd4229367cde23085b8d57549093ce8e991eb4753ce58c85fe
GuLoader
76539c09f989d3cc938d6984f9ee8b6680fe2416822d63bf53a1712aaf9b695f
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
d74ec4c8e4b38d5258d5fcee7364b8dd0eeb165e6b0aa3edc544b160ceec7f89
GuLoader
dda25996ab5b78fa63ab71aa304360374fe2eb6ded670c778b2c69d9fa1f1e40
GuLoader
ef8f03a25087eeab581d8439a0a19ba7148270d2210d479c1d6867fac69dc813
GuLoader
+ 209 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-w6v5spmcys/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/3136/
Cape
Cape
https://www.capesandbox.com/analysis/3004/
Cape
Cape
https://www.capesandbox.com/analysis/3002/

Comments