MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63a5b27aaccab499d4e56d6606d9495484685be3f63817f9e90a61330bcffe38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63a5b27aaccab499d4e56d6606d9495484685be3f63817f9e90a61330bcffe38
SHA3-384 hash: 4873ecb778db4630f1b69c8efa691c42f3c0363927d85a926b91f5afb3a6b081182e35ea67b299a56aeb3e6c66a36611
SHA1 hash: 9c74e5e8b41517ee9da8c7b9e637ba663980933a
MD5 hash: 261ab203a73e697a12b730c63b16ff8f
humanhash: finch-wisconsin-lactose-princess
File name:261ab203a73e697a12b730c63b16ff8f.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:77'824 bytes
First seen:2020-06-02 11:01:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d33d510f32b655cc1d7082f8ee294303 (1 x GuLoader)
ssdeep 768:WbXuj6u921MfnN07UDFkKDbwrj3FlGTEvfgWb2qH7UvKIF/:Wb+j6uaY8zgdTEHwv
Threatray 2'327 similar samples on MalwareBazaar
TLSH 47733B1AFE898179F58949712459D163BF297C3265029E0F73006E6EAC36987FCF132B
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1pj2uCw8tnouaiQ7cxtxySnCq2lrnpgpF

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6055/
Detection(s):
Win.Dropper.NetWire-7993073-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 05:47:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mos3e6vmzk2jtvhfnvtanwkjkscgqw7d6y4bp6pjbjqtgc6p7y4a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
guloader
Create hunting rule
Similar samples:
0494c6b3493335509d5fdce6d9592d796e592fee648f42dded58ddc29e3565a1
GuLoader
168cd5b5e4d1dfec48777cdc97b74c7b33dca67d176f9add9bb94fa89905db38
GuLoader
23eb70abd818d93364ae2f896425d05fd38788c54429f874fabade1671b267b6
GuLoader
625d65e2f28c0eb382f79567e2688de8188fa6606f6add912c74305c6f560718
GuLoader
a7b55b6bfafb6d370f94ff25e294f90d28818a1842ecad4546d18334c616cb97
GuLoader
b282b41544510e59a40e875239a18b038243be344b1439e19d821eb7622e9230
GuLoader
bf6d2e90c5fd6b327f1e513402eb01491ac8487b682243450ad684de5e6e62d4
GuLoader
dfe66d2e7938bed4e4452f82519a8b02d0ac89e74341a4abee8b2ec1c6a7ffb6
GuLoader
e0a55cba6885e046f0eb064179877af39b10f3d8cc74b8c697ea7c8cda6ab739
GuLoader
f888221496147b75d54210c499498b02780082a4e241575c7374adf58c38d902
GuLoader
+ 2'317 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-qjqce75tba/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/url/373406/
Cape
Cape
https://www.capesandbox.com/analysis/6055/

Comments