MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c23d6299d9e38b49ba39a45875bbf30a1423cd9666e1734c5f954930a76f4cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c23d6299d9e38b49ba39a45875bbf30a1423cd9666e1734c5f954930a76f4cd
SHA3-384 hash: 033545559c9c8eb67aa5ec794d09aaef44eb4314734dc67652405edcba45c7febd78e9fdc17a4aabeaafe2e36c5f98c1
SHA1 hash: 19529152846dafbba3d1ef696fefa66dca055889
MD5 hash: eac08c9f02965deeee552e064534cc63
humanhash: avocado-purple-crazy-sad
File name:SecuriteInfo.com.Trojan.PWS.Siggen2.48361.29933.7538
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-05-06 11:35:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 62049cc92047227ceb3798ade2723da4 (1 x GuLoader)
ssdeep 1536:I1+JmVec3X+MpH7hJl5Mxh3/hq+fyNMjupnktFg:JE+i7/l5MxhPhhfdyneFg
Threatray 157 similar samples on MalwareBazaar
TLSH ABB320405EA5FC1AD9A93AF2DB35F09DCB906C35A870721BAAC0715E1F394909F3076B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48361.29933.7538.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 09:26:16 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
08573c8eb12aabb14b6645a6630c8ab937bc9e36e1883d23062bfca41bb438e8
GuLoader
4729e8e24dbf89c9ac42039bf7c462a3cdf0fe732b981eaa566cbd03a6cb4268
GuLoader
4ea2f3bcf61af074cf7b6f6b566c95bef78126999cf79a5c6b67e0df9c0b28bf
GuLoader
59537f07eaef89b19794f6c71c2e58a1d55a778804fdd614301d184495efa33f
GuLoader
712e43ae7f3f228367ad7a3208bd6f1c1f38628a699a22dd3e2744545b724344
GuLoader
b3e92239a3565de8f57e3db18b8cf4563a690e82b0072f8bd06721d6e95e8410
GuLoader
d9b4215f118a22d7ce610c93d49796c66e6d7a2177149b667d2fa0049f1d09dd
GuLoader
db1a6e4c123218f4eb1bbf4720dd0ac58ceb2ba667d5c987c5e83c45de560f35
GuLoader
fa99453512105bf46824ba46c52de05468ccee072549e41771c4f3633f94d3a2
GuLoader
fcf4597470e4342ddf7911195ac0069baca4dcef90e31c0bbd889153312c9ba5
GuLoader
+ 147 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-a7rlp4eqnn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 5c23d6299d9e38b49ba39a45875bbf30a1423cd9666e1734c5f954930a76f4cd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/358753/
  
Delivery method
Distributed via web download

Comments