MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e7792550edc1085dfffcf3dad7dbc31e164c7149abdce5bbaae0715106a2e1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e7792550edc1085dfffcf3dad7dbc31e164c7149abdce5bbaae0715106a2e1c
SHA3-384 hash: e1c536c1cfe1ce3021739a9726dcefc19b97d3cc6f2fbc4f32104b5794db6728709d5f539dc450f9bc9fb0b01b543f8a
SHA1 hash: aa00c75bcb92bb3286e6e8b10c4d40135db3a2a6
MD5 hash: 6245a28f7c93c175879998bf0312809d
humanhash: oven-mobile-two-foxtrot
File name:SecuriteInfo.com.Heur.PonyStealer.fm0@qGkKMUji.4243.25482
Download: download sample
Signature GuLoader
Create hunting rule
File size:81'920 bytes
First seen:2020-03-23 19:51:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash eb3768a31344aeff5660f0fcfb677b3e (1 x GuLoader)
ssdeep 1536:VwKCMOsfz0jtDQtbfZPeM4s+p1m1S8/O2x:ofsf4pDQtbfZP++p/Z
Threatray 888 similar samples on MalwareBazaar
TLSH 24836C03FA00E861C89DC73D6C47D7A215277CA96D41D69B36D47B0F28F21628F2DB69
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Ponystealer-7639410-0
Create hunting rule

Win.Malware.Generic-7639438-0
Create hunting rule

Win.Malware.Generic-7639551-0
Create hunting rule

Win.Trojan.Vebzenpak-7639767-0
Create hunting rule

Win.Trojan.Vebzenpak-7640209-0
Create hunting rule

Win.Trojan.Vebzenpak-7699953-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-23 13:13:36 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lz3zevio3qiilx77z46227n4ghqwjryutk644w52vydrkedkfyoa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
24d03d6c5c672bd7d70f83c827f4e6fdc3ae9b7a145bbc51d8548c55005b97c0
GuLoader
2bdbd53d3ee98405667b623e44a3d2bb2310c0dc3e6ff3e316038b94c4dc93fc
GuLoader
5cc55fa0f006fc7c39f68a9aa2d7c2debe52c0e9f8ee955bacced2cf0d2aae8b
GuLoader
87932619be6e86d93f1b43c1b1e0ac1eb49195c9eb1cdc8264222100be76e220
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
b6815b7c6bd39d114da295e839d472997b073db3d57429aadad20bb73c7b47c2
GuLoader
b6e65205eb258b1860e98244e346de97593618177b6da2db887f2d345be02b28
GuLoader
c7552fe5ed044011aa09aebd5769b2b9f3df0faa8adaab42ef3bfff35f5190aa
GuLoader
c76654971c4af60511d3583a3bd00c673904569aa93973687e14e95b9e80de6f
GuLoader
+ 878 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 5e7792550edc1085dfffcf3dad7dbc31e164c7149abdce5bbaae0715106a2e1c

(this sample)

NanoCore

Executable exe c7434a901ef82dba7f31d229cf40797bae4b6486378262b55120446cf469bfe2

  
URLhaus
https://urlhaus.abuse.ch/url/328893/
  
Dropping
SHA256 c7434a901ef82dba7f31d229cf40797bae4b6486378262b55120446cf469bfe2
  
Dropping
SHA256 c7434a901ef82dba7f31d229cf40797bae4b6486378262b55120446cf469bfe2
  
Dropping
MD5 3b745bf26ee078eda40455254b39b214
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments