MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 552f8a15f83c9c40034cbada93c326a24b8677d7413e8395bfd7f3a6461d33b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 552f8a15f83c9c40034cbada93c326a24b8677d7413e8395bfd7f3a6461d33b3
SHA3-384 hash: 5f2f3643b49af7a1cdb446ee794d92bbe9f6b476cde52910ba3ace331158248d5bafa3eb44c8fa7f7337aa9d20813fc4
SHA1 hash: 53143ca237a82f572912859931eb43acef6977ce
MD5 hash: e7afe57edfb93f67dca06e717046e360
humanhash: yellow-xray-alpha-undress
File name:Shipping docs INV+BL+PL 0026180_doc.gz.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:176'128 bytes
First seen:2020-05-06 06:20:34 UTC
Last seen:2020-05-06 07:05:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1eeb7e5b1a3b0199109426abccddc7ca (2 x GuLoader)
ssdeep 1536:N1k/eDI1wZc3DwbEMwAzFcvceLEimb9lbbbbbbbbbbbbbbbbbbbbbbbbbU:Nm/eaKEzAuv/E9o
Threatray 262 similar samples on MalwareBazaar
TLSH 4E04D6A0B5E0EC36C5457AB2EB40BC7DD3F46C35D830A512AA8DF2C51B35DE1AF2121A
Reporter cocaman
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisE7AFE57EDFB9.11579.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 04:04:23 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kuxyufpyhsoeaa2mxlnjhqzgujfym56xie7ihfn727z2mrq5gozq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
167d491785e99c6aec1e23ef064eceb9e7ac81af33262d7e3d3e51cc8759ce70
GuLoader
4860f303cff9925131edb7ce8b5ac727869bf318a88aecb3a31a258f2679de5c
GuLoader
83e97420dbe39c6e29e2ae3dad80f21afe93d1b6ea88962a89762cd64772db41
GuLoader
aff13266e5803a58effdba6e01d44dd6b083db453a0dbf2528f5e729d33918fe
GuLoader
c0a66966676974f8b853ba487eb3e06e8952ccb0f9d6930bf2d1c67293ee21f1
GuLoader
d025b24f7179db8dcc6dda416f90220e9559dde564a5b24c0dc7a02fc823c97c
GuLoader
d8e693957ed5178a7f00b1c5705dae298b7e04da07d5c154a6580c031369d6ab
GuLoader
eb69f1b5d596096808339dd39376f1685bf94376491a8df091c9a788d0dc1ef9
GuLoader
f17c37c6d5e56b96e7d603d1eafcb885b8c229cd1a6ec1d669b1dadcce59bdef
GuLoader
f85b3852381cfbabd654be01a21ffbb798a0feaa3f360fff66f27d499c174898
GuLoader
+ 252 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-fb65v5733a/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments