MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64e277226ed8348102a4af90ee5cfd3624712a5376c447e16b72377c9d6c3acb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64e277226ed8348102a4af90ee5cfd3624712a5376c447e16b72377c9d6c3acb
SHA3-384 hash: edb08d6d2f51982ec3b0199748115ff50b253eab7f67b3c6005bff9b4740122d9f646118faf39f3e3c5b5e2ca9ddedbd
SHA1 hash: e73c944922084bc3ce3882721a46a25629682f1c
MD5 hash: 202529ddb3ac1bfcd6141245e249d796
humanhash: spaghetti-timing-east-gee
File name:SecuriteInfo.com.Mal.FareitVB-AC.18816.12878
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-22 19:43:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 42c0120e19a589206fe92cac54611eb5 (1 x GuLoader)
ssdeep 768:4KRI2aAQX4Hez3FBoW28X6+cZTM4UC8lNXjvcttR4FO81maxXbdnDlKZz+q:9RIrX4+zfoWn684UC8bTvFF7xXFkZz7
Threatray 701 similar samples on MalwareBazaar
TLSH 139329A5B961E8A5D8200BF15D778768246BBC341F010B0F74DDBB2E6933D4D897A32B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

SecuriteInfo.com.Mal.FareitVB-AC.18816.12878.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Netwire
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 18:13:09 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1d117728ec260d80f6c6a347c4c32c965c69ff10bd4f08444fc70e82eebb1094
GuLoader
2e4e588077024fa1b6e3a621faef00f099fdf962d850adc1895cd0d878a1e8d7
GuLoader
6217eb209fb47afe8f9f9d99160fc920e1f50066f3be43dbd8e48ba8695f1c51
GuLoader
6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4
GuLoader
6c318da83e3d6644f8e3cfc7b57627970cbbd6a607c7c6e661c3bdb9bd20ba44
GuLoader
a57304043cdf4e54783b99ba437e2dedc5bded49da0878e17c459ba37e41bb55
GuLoader
b5e4950f8979f18ad063f3df3fb483aa88273271254201dbc0e5241b7713edc2
GuLoader
baac016255a128a1209211bba2a47979f3392f12c41d5805469f899eba6de47b
GuLoader
d3aa9fd1ed4af3cc3a49e612b93a03f799ada340c1c086f7403448fe77115bb1
GuLoader
dcafd8ba263cf7e448be257a8d25c968a0060908f93f9d02a068bb0dd482879f
GuLoader
+ 691 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-rbxjqelt1x/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 64e277226ed8348102a4af90ee5cfd3624712a5376c447e16b72377c9d6c3acb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366806/
  
Delivery method
Distributed via web download

Comments