MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 610d402c4582386b2f01e1297d386c62f19b2d3f89c0f0db0e9c232e7de99c4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 610d402c4582386b2f01e1297d386c62f19b2d3f89c0f0db0e9c232e7de99c4e
SHA3-384 hash: 0af7338879410131b73cbad132bc2f0b2282992ddde60b65b36cb0d0ee94f15c69326407becf7e99edcffee3f561c2a1
SHA1 hash: 85d8bc746306d76aea3426cdab2a5067c1fd606a
MD5 hash: 6225e673d886b6c10c874070d7f582d7
humanhash: mountain-pasta-bravo-tango
File name:RFQ#87645-975.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:106'496 bytes
First seen:2020-05-11 14:49:19 UTC
Last seen:2020-05-11 19:09:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 760460bf1cb2bc0adfb203aff422cc53 (1 x GuLoader)
ssdeep 1536:g2geC6NxkzRB1iMW2ZcQ1KukFzVNFxbl3S:Y1SorKui9+
Threatray 920 similar samples on MalwareBazaar
TLSH D1A3B55173A4FD37C9658EF20712AAE501F90C75A82026176BC77AEF163AC76E27031B
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Agent.EQKK.29598.8778.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 02:14:00 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=megualcfqi4gwlyb4eux2odmmlyzwlj7rhapbwyotqrs47pjtrha._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0631509955b475ffd66cda5560340cda6cb3883399665e56b3e65ffee82aef21
GuLoader
0fc20e3e9fe037a0de30f8162d618a0b8e634bee0fa1bac1f1219a9adc4d6016
GuLoader
20629897fd36f8cdb5321d1c58b8acb62fa29c54c0e22b1d2e9e6bef807f7e4d
GuLoader
4466374fdf3369692e79649be6345297fa9a4f5b05f8f932d33f1b1db19ac3af
GuLoader
4cd079bdace5892c891383033182a97b684daf643f9c4572faf7e4f416f9c505
GuLoader
630ff6cc27be458de812bb51580a983819505b604f68e14373338a05bed0ee6b
GuLoader
7dbbac1168364d14fbee670547dea6db654c0abd668ed9a39d669bfd7efa8496
GuLoader
a2122ebb9e4bc5af911c6934c8c42a006d7da62327f81e0049b02f852a1fe98e
GuLoader
c360eb0ad06680e9de7f26e19b25c52f6f8886da5042fb4bbe906d5e94b8cd98
GuLoader
e920edae93d44363b7f23b7eb55d9074a5781ab05cdace625283ba73bc411524
GuLoader
+ 910 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-3m5mqqyvxn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip bea05ce564daeead92bf8636ed5b16a23344a8fa3e3f4f17df837cf79768f83e

GuLoader

Executable exe 610d402c4582386b2f01e1297d386c62f19b2d3f89c0f0db0e9c232e7de99c4e

(this sample)

  
Dropped by
MD5 bdd928d42d047b14455fa699e6b34a2d
  
Dropped by
SHA256 bea05ce564daeead92bf8636ed5b16a23344a8fa3e3f4f17df837cf79768f83e
  
Delivery method
Distributed via e-mail attachment

Comments