MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a44cbe60853b3a9446a1ca10802ee4767cdfca6cf05c7c96ba7799aa91eafee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a44cbe60853b3a9446a1ca10802ee4767cdfca6cf05c7c96ba7799aa91eafee
SHA3-384 hash: b42ba000abc2bb7373fdc33e5472f810ad357565467e9dc2a381ea067d82fa95fc0cd3abb98b07d0fb5a65b2d1385d93
SHA1 hash: 8f92bef74c89aa8eda114b69a7efd1dcfb9b7315
MD5 hash: 0afefc559ee57ec6354ce5e01e48982a
humanhash: king-december-don-tango
File name:456098#.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:180'224 bytes
First seen:2020-05-18 06:28:19 UTC
Last seen:2020-05-18 14:09:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a3537adbfeed707ec0e6be22427544cc (2 x GuLoader)
ssdeep 1536:xhaqTMdmYLpiqNJo+L44ArJPQObMx/6Q4XVgDT/G3uztR3Dyy+0yY68644:GqTMdmY9NW+L4nVm0X6DjDt9yyVQ8u
Threatray 701 similar samples on MalwareBazaar
TLSH C2044A22F5C4AA0BD620483EDFE685B95526BC704E60CD07B1493F5F3AF6906A632727
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
4
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Graftor.751753.6961.20879.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 06:35:49 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ljcmxzqikoz2srdkdsqqqaxoi5t437fgz4c4psllu54zvki6v7xa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
396c67d17bdba56c29d4774991879313c236e9db5b9e1173f322d1bd3194edd1
GuLoader
3a842ce737983d2dfbdf7974d30373cc0880bf054af84284d7a065ed3548f43b
GuLoader
46387625361cd440a23520b7bda25f402b586d00a44229754ab776e5e1bf34f7
GuLoader
8926bb6b6590a5a180cc10a7cedfb5df1e5d12013aeb23224bf917013ccb25a2
GuLoader
a45d9c8d3f5ceb809b8ee497e806d29d6e379ae0603aea8b733096afcf86bdcc
GuLoader
ad64a6eaa5d2494a4161158792e7cde3fb7d9a7bd36f06cc0de271192582f439
GuLoader
d1148a8f019b2b901f2c089bd7e77eb55c61efa5d6cbfb65e4fa1868476c9dfe
GuLoader
d335fad41e3f9b09effaf617e6c56554b667191c9c94f4b644a15b396408858b
GuLoader
dfe54696ad7c10bc44e524a6d292f94a951bd29aa1f4dbee29b6ae56eaf9fa51
GuLoader
ed33a55395aa0b7061266a9c61b87fdecfb3fd0605ac1ca342751f9deaf25930
GuLoader
+ 691 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-qv172pyxwn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip bfb21a94283a7176a0c97198b3e3bd371c064b941da2ca0804d1d2abc1a9eca6

GuLoader

Executable exe 5a44cbe60853b3a9446a1ca10802ee4767cdfca6cf05c7c96ba7799aa91eafee

(this sample)

  
Dropped by
MD5 f753a21a5cb154357b4d8c592a8265f7
  
Dropped by
SHA256 bfb21a94283a7176a0c97198b3e3bd371c064b941da2ca0804d1d2abc1a9eca6
  
Delivery method
Distributed via e-mail attachment

Comments