MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57bb966172a1d6bc994a682ef5da9b8b8fdabef539f44024c7e9368e6416d457. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57bb966172a1d6bc994a682ef5da9b8b8fdabef539f44024c7e9368e6416d457
SHA3-384 hash: b852079ddf41671a1f6930dad1fe8ba69a3d37d4d6646903150138e8562ea527bae36ce274a1c95b8a909b3363188c91
SHA1 hash: 984b261b9826920c531d6e692e94164b71da0520
MD5 hash: 9242b0ac21d63b8b11b19b0ebedca566
humanhash: ohio-oxygen-quiet-island
File name:9242b0ac21d63b8b11b19b0ebedca566.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:77'824 bytes
First seen:2020-06-01 08:26:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c9ac5f2d87ad26f02dffb0bc97521484 (1 x GuLoader)
ssdeep 768:olYXuBZjpY9P7JDI0u7W7mPcJk5FlCTavfEWqhYIcfleVoD2BmqwcZRKcW:8Y+B/Y9VWUlksTsWR
Threatray 928 similar samples on MalwareBazaar
TLSH A5731B1EBE5D8579F44585712459D0A6BB2ABC3218029E0F73016E9BF8B2983FCF1727
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1PMlAGJi2TCvjcdrsfIPxV1In06rn1gIi

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ispy
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5510/
Detection(s):
Win.Dropper.NetWire-7993073-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 08:36:30 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k65zmylsuhllzgkknaxplwu3roh5vpxvhh2eajgh5e3i4zaw2rlq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
32988d9efdef04149dafb7aad85acfc026b906452b1c6a11b5e8402157d20691
GuLoader
4af9eb9a627fd64924f12a6a972423e8c5a553108be81d0ee259ff4de7d638b2
GuLoader
6d043b33b33e6baaf7514b9ca56f8dbd8aa57bc71a9040bf438bc780c1a4ad5f
GuLoader
73e1d44799f6f7dff81192f5a25a8fc978f3e1aaf5c94856a94ccc43ef2fc888
GuLoader
748970d868ca12ef96a98cad33b9f3c7bf7ab20ce2e595d4fdaab152e50b29c8
GuLoader
7522e963fbeadde98b1486f0d8d2d1a15011812b06d06f1a5bc21caee6876e71
GuLoader
95b7bbca4d924be150fb6858b8546d3386d44a8a589a7a60ab1a0961718ee84d
GuLoader
bdfc8efb0dd8f8530002fca468d1234513bf740a9515269621a83f9af1128550
GuLoader
cabdb16b578bbd7855d7d244a8bb49dd9542232804e22a809ff1b1805f35e976
GuLoader
d99947df7b80d4cf1f998cd4c205df67be0afc6ab0d9b4d92988b1aeccc1bf0c
GuLoader
+ 918 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-me313zcc7n/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 57bb966172a1d6bc994a682ef5da9b8b8fdabef539f44024c7e9368e6416d457

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/5510/

Comments