MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 512a9dbd3e78c1932f14c8ce9c0177b3ca40564928ad75280b1a2448b0a353f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 512a9dbd3e78c1932f14c8ce9c0177b3ca40564928ad75280b1a2448b0a353f6
SHA3-384 hash: 3ccf365333d577f17c5299432c2dd8308dd2d2031f4e5dd1ce23820d47b71a7ed28fff752d5989d0d754a37b39391508
SHA1 hash: 7eaba48e3e3aa88c53f212f3180f3db88792902b
MD5 hash: 657c616e8507bcf7ab3f847a91ab10ce
humanhash: freddie-indigo-fourteen-snake
File name:tmp.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:151'552 bytes
First seen:2020-05-20 04:35:47 UTC
Last seen:2020-05-20 05:35:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 57831ac6a01a5305d27e80ab43350d5e (1 x GuLoader)
ssdeep 1536:SRY+4a0OiUTNI/8i/iP9071djRIR9mnYO3eZDyBP7DLCdm:h+gOiXN/Y6SR9mugl/J
Threatray 233 similar samples on MalwareBazaar
TLSH A0E38C60F188A98BD2615ABECF61D9B855367EA44F12CC0770C93F4F7AF2A069931317
Reporter JoulK
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/4341/
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47253.23331.27624.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 03:18:11 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kevj3pj6pdazglyuzdhjyalxwpfeavsjfcwxkkaldisermfdkp3a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
01409a8c1a4815214036cdac1796e2a6b680f7149b2117346a1f01b809a18754
GuLoader
1f057ca53fc065ca47ae62409af791cdd7c422a1080a4e4f7985987725ab9350
GuLoader
2c0fc1518735d0f354fbed168c2f96d51cfa0e0ebf2dac3f7179a0b5b462e5a9
GuLoader
34d6b5b7b09f0d4c0228f41f8e262278b3d9b9708d37be7f18b05bf6a79061ad
GuLoader
8092f7adff425c2972f2716e2d31fedb1057c692eb8f0d4ca65d1a97537932a7
GuLoader
8632fe4db48026aebe76829dc79cfc6f1e94670507a69e6d11a1b7abde3d5612
GuLoader
885345d6e648c3ed211fcd7f23a0a4207b8f8f90226cf2dbd8325e8ec8e2ae80
GuLoader
beb2824122982ae356642d0d46c7fba54424687558a35df7e0b22263f9587332
GuLoader
ee01a3f2f668d1fc9a371b9234eb1352b5503430a461fa3c875a990aff72fde8
GuLoader
fc51957298f981557d270415f537221f6ed34313a7ff59982e1a1f8366f30b48
GuLoader
+ 223 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ja3v53xsq2/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/4341/

Comments