MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 578ebd08634c9e158e553b27cfe7e26435e93d3325d53657d3ffc3eec83be71b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 578ebd08634c9e158e553b27cfe7e26435e93d3325d53657d3ffc3eec83be71b
SHA3-384 hash: 12b7c209b15da185bec11d59e2bbff59c13a5bba7a234f380171a11dedeede416977f14074f55721e7a11117288d863c
SHA1 hash: 2a168d3a01851171d96e1222639cfa99c4e122ec
MD5 hash: 31b8b30d1467e6cdc3944dc8dd0068b2
humanhash: six-jersey-fifteen-autumn
File name:P.O 465 Arrow chemicals_DOC.gz.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:151'552 bytes
First seen:2020-05-17 10:02:21 UTC
Last seen:2020-05-17 10:35:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c067db778b06361253f5e5e563abd771 (1 x GuLoader)
ssdeep 1536:NzTNPuuC76rvrb5ekie+KYrlbbbbbbbbbbbbbbbbbbbbbbbbbI:ttAmtYu
Threatray 326 similar samples on MalwareBazaar
TLSH 87E36EB0B2F1F07AC61486B226457DB003FA5C14DE11A922EDCDFAE82675DE46F2170B
Reporter cocaman
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33847179.24920.2088.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 04:03:24 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6hl2cddjspbldsvhmt47z7cmq26spjtexktmv6t77b65sb344nq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
02ed63cbeaf40a7221a007c8fd3641de0406943ac82f49cc5b3e85cfa0e17ec3
GuLoader
0de340a2a9794b550122c8fa1ec237c8d10d1b17473f93313394de1be0906d35
GuLoader
5281b04770cbfc7ab88d17ef529b8c59092d101e349d0140a8645da16aed369d
GuLoader
6a9bc3a1eb4f814af952f27066b70136b9cd7ad980f705dad5bc91b697888b5f
GuLoader
988b22396032c7352be36c70d738091e7df261013cb1161194e8dc416fd15fe3
GuLoader
9d8dfe823511ffc0ad4556618f8a1b99fd533a06f0323788c7d093efd9446099
GuLoader
a2322a27796d9f34f31d819e417d4eba3d1463ecb81b4b7aa1791812aed28a63
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
e01f7d5f5a34bc9fde408c3f3fb441b76b6a2c3e2915cbf98ac5ca84e61e2b5d
GuLoader
e1ff1c16441255468cf921e8b9a455c957f73a2a433aa469349ee7a6d5e916b7
GuLoader
+ 316 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-85bnx2g3x2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz bb69da87d70a11478dd89717e603870cd0ad0548efe63009237cf7d278fbaba7

GuLoader

Executable exe 578ebd08634c9e158e553b27cfe7e26435e93d3325d53657d3ffc3eec83be71b

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 bb69da87d70a11478dd89717e603870cd0ad0548efe63009237cf7d278fbaba7

Comments