MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 677825d1c55ffae0ee20b966bf6e7318fd6e0ccbfa1c65a1c42d19997fcbfc06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 677825d1c55ffae0ee20b966bf6e7318fd6e0ccbfa1c65a1c42d19997fcbfc06
SHA3-384 hash: 09deaee6e70474df35ec89c69d64a02786fe563b9ecac4b2edcfa69782be6bac66837ee4198b34e99ffe4993c359b8c8
SHA1 hash: a8bfaca8d60923e3c94b986b25eef3f79895c421
MD5 hash: 641df2dc7c46a9a4a2b9c3b54c74f85d
humanhash: johnny-papa-lamp-coffee
File name:Payment Advice.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:126'976 bytes
First seen:2020-05-08 14:25:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8f8a0f2aa1514833a2c80043398d57f2 (1 x GuLoader)
ssdeep 1536:lticSSyzuWy9reTD8kdIlTQKu70w+OFpsLa3cOY8PwC25i+TVwZ+LEC24:ScSjkmKQ/70w+YCLwLY8PB28+KZ+LhH
Threatray 539 similar samples on MalwareBazaar
TLSH 2AC3948573C0F257D5E80EF2575A83E115F8AC39AD852B0B7BC8B11B6638E15EA21373
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 14:25:42 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m54cluofl75ob3raxftl63ttdd6w4dgl7ioglioefumzs76l7qda._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
042359241a3a3f4d635527751c2268cc80121586dc68c9a6732edb20d25ce760
GuLoader
1240a7ff417004b8b3b98ce0d7adc1f959178e730590b45b2cba92c473fc0b89
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
4c567d47335c4c7a99133643e137e824203b8958b44e1c8a0aaef7a6aed39cf1
GuLoader
52f137c22685d15df043daabdb9c823e07ecec4df42bcc2fa2c5bd45913d32ea
GuLoader
9532627f43a3de7b9c4414517f18197a08969adec3c24e1c2f1856e32613d5cd
GuLoader
96568402add3b23971d79fa6730a1bd054509512e1d73cefec74c307aa46d436
GuLoader
ac4035cfb9c8a93c294fe1911bd4cd94ce403d8cdc301fa4bf113144b40d1245
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
e6ff6d164a876c50bfc4a6f7b6397914f9656d0e4aef1ceba65f1e92ed1b6c69
GuLoader
+ 529 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-meme8y6n16/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments