MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 653519cb7879ba9389474ab6fb92ae69475ea3166167e3b9b1e4405e14506f5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 11
| SHA256 hash: | 653519cb7879ba9389474ab6fb92ae69475ea3166167e3b9b1e4405e14506f5d |
|---|---|
| SHA3-384 hash: | f4489b0aec9825f50c9f36314b4fc28367aa0dbc563bc9c8ca8e2c23d08dec30e557b5dbfb2a8e4ca0b2edcb113a116e |
| SHA1 hash: | 6c4090a1186f70820d2310ea97732e14413a41ed |
| MD5 hash: | f8c61898c1ab389df90d8af4c8cc089e |
| humanhash: | oxygen-nineteen-virginia-eleven |
| File name: | PAYMENT ADVICEDF.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 529'441 bytes |
| First seen: | 2023-04-01 01:18:53 UTC |
| Last seen: | 2023-04-01 03:19:19 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7eae418c7423834ffc3d79b4300bd6fb (51 x GuLoader, 16 x RemcosRAT, 15 x AgentTesla) |
| ssdeep | 12288:lswFjJnKlIZ0G0+IaH8aFwF4I3olFcC+/z:ls6jklIZ0ack0gFcb |
| Threatray | 622 similar samples on MalwareBazaar |
| TLSH | T193B46AE2B8446288E9795E73712B2C6217751FBA622C205CB6CC315D09FD1727EDF82E |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 2b26061e391d2b6c (8 x GuLoader) |
| Reporter | Anonymous |
| Tags: | exe GuLoader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
243
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PAYMENT ADVICEDF.exe
Verdict:
Malicious activity
Analysis date:
2023-04-01 01:20:10 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Creating a file in the %temp% subdirectories
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
comodo guloader overlay packed shell32.dll
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
GuLoader
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Signature
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected GuLoader
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.GuLoader
Status:
Malicious
First seen:
2023-03-28 02:55:32 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
19 of 37 (51.35%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 612 additional samples on MalwareBazaar
Result
Malware family:
guloader
Score:
10/10
Tags:
family:guloader downloader
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Loads dropped DLL
Guloader,Cloudeye
Unpacked files
SH256 hash:
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 hash:
8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 hash:
7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SH256 hash:
653519cb7879ba9389474ab6fb92ae69475ea3166167e3b9b1e4405e14506f5d
MD5 hash:
f8c61898c1ab389df90d8af4c8cc089e
SHA1 hash:
6c4090a1186f70820d2310ea97732e14413a41ed
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Dropped by
guloader
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.