MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5da6c70f145dcb4c50abe95e6b641d3a4c24fbc74f02b19aa40e574b25eaecba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5da6c70f145dcb4c50abe95e6b641d3a4c24fbc74f02b19aa40e574b25eaecba
SHA3-384 hash: 43b629b5db550d7c93fd7d2fd927ff904a459836f89f06a6d2b3a85a054712273f0468738491756e7badd3d3b7f3eeed
SHA1 hash: e51450139609ec06e9aae677005d8c1a90813d38
MD5 hash: 3faa4f81a11ffdcb983e3dcf1362cef5
humanhash: yellow-indigo-delta-dakota
File name:order RFQ-HL51L05.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:143'360 bytes
First seen:2020-05-06 14:52:42 UTC
Last seen:2020-05-06 15:46:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 17d0935f6b1cdb29f3fbc75b44e0a43d (1 x GuLoader)
ssdeep 3072:9ih3Rsrl8t/7DSlGdzzCV0pI5iOdHpsD1ShB+Eoab1FN9:9Y3Vz2Id3COIiORpM1S/Nzb1FN
Threatray 209 similar samples on MalwareBazaar
TLSH 09E33E985A98EC13D45878B2EB82F95ED3942D35B832631373C0772E2B355A1DE2137B
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.FareitVB-AC.2107.29920.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 10:09:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
025ce893661f87afc7352a9f89403e337a4e6d982ef3d97cf19e74674cbdeed3
GuLoader
133b27bbf63dcf79d89bbf8b46be58d0219323be3d3e428f5e1c7feba7c55f89
GuLoader
350b35550e10e3ed50b1337e8899ab2eb9c9cbae7c077027f52bab3c5266bb84
GuLoader
7cfa97a92b4242af9657fe87263b30a68d06f7d360c565f362794618713e1774
GuLoader
7e60af333b52731e98a3c49c7e0ecca12d86c8277f4e6f8f118fd021beb5acbe
GuLoader
8077b9d3b809c1b66793e7292d7afdb401efa60fe9be607bb48a30bcf005af06
GuLoader
8560db7181c690430d6f38f8b3675e881dcba44904fac74f15a0df136dfa8251
GuLoader
f1e6db23f71358086c0a6d54602989535e6c25309d92af9f0db056d4a372fe8e
GuLoader
f5b55fe9b33435e6a2053e16b843b5e89f3f4f3c8dfaf778386f2896b5ec4b7d
GuLoader
f6cbd9ef6fbc0c2774a4bf2e43aa01804ee0294a453e8254f5a843a40051da31
GuLoader
+ 199 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-199k3ytmkj/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments