MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65b26141d162b4b392d2b18c07056bda8aadb778445f3fae73c9e75d6b639ecc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65b26141d162b4b392d2b18c07056bda8aadb778445f3fae73c9e75d6b639ecc
SHA3-384 hash: 583306c4abeef1598407876d55a565edc1cd006164a7128c385b538450707f4ade17ce1badb7d0cf6bc1c92d6d41e829
SHA1 hash: 6001b6b30b26a3ce871271a48798e3a63c7446e0
MD5 hash: f7ed53ab683923af4a6d162a55c58620
humanhash: fifteen-solar-illinois-harry
File name:SecuriteInfo.com.Fareit-FTAF7ED53AB6839.22992
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2020-05-07 16:04:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1416874418cf29057e4c22d74ef00445 (1 x GuLoader)
ssdeep 1536:A9eW6MQrU+yV2JfuL/fdComCsnY2AAd5mR:n1QR1sCUx+R
Threatray 999 similar samples on MalwareBazaar
TLSH 04A39425AEA4EC23E06879F2D715B26ED3C15D7124B24A0733C1B62E6F79911DD3232E
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/2989/
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

SecuriteInfo.com.Fareit-FTAF7ED53AB6839.22992.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 13:51:41 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
08b47c6d183afb72f383ced4639ba73a03d9b36f06617585b3a3d28b69d1ce9f
GuLoader
10fb1047794d9a933f644978c5bfe1eb5dd2d66b87489823f69ca414d2688537
GuLoader
37d7bba1bacdbcb35e301c1fc391449ea84d1203ca59a8b1f1142acf4596e032
GuLoader
3e487a6e78ce053ac4add56861cd380be9c2920d292f83448c0a3f8a814c53d7
GuLoader
463bda53d68b37fa531bc31652d2f76a92c76f3311707fb7a0037b4f3a5445d4
GuLoader
4fe68ecc976811b7c7acfd841f0746446f97e271b40819e93a35b17788767f9f
GuLoader
8869b2576e5e5ebd15edee49935a89a27bb6dee506483a27f805f708d4bf8957
GuLoader
baeafce74cc8a5c40bd2b6ba2e38312834e48f23f655cfae1d1ae8e78e375b84
GuLoader
d18ed67b05d0bbd6dfaba77a6053c92674bfef8abc8c7aae7c17f703adc6ea5c
GuLoader
d7e91c4ae1a0b9f6bd1c2ae422b2d9488949110017b9d06001e6bcd386905c8e
GuLoader
+ 989 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-bllc38xjjn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 65b26141d162b4b392d2b18c07056bda8aadb778445f3fae73c9e75d6b639ecc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/359310/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/2989/
Cape
Cape
https://www.capesandbox.com/analysis/2988/

Comments