MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73c6461867083483568798834d7f557a61696d61d0eae801e95977f2704a5af9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73c6461867083483568798834d7f557a61696d61d0eae801e95977f2704a5af9
SHA3-384 hash: 3b98ee471b845833d2e362885a4745764ea9269c58f15d7a4bd96e9d6080ce2caa05361779c30dc63b4af19a792b23a3
SHA1 hash: 00807512785b7666b8d95c1db1aa173e1836f766
MD5 hash: b8e8c23b254b58de02b7fd509a1b394a
humanhash: diet-sweet-sweet-paris
File name:SecuriteInfo.com.Win32.Injector.EMAG.18229
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2020-05-19 19:37:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c7668d828a1b9abf240c119d958d3dfb (1 x GuLoader)
ssdeep 768:gsUE2hvhkEzQYZTdcMFsI7ed3nfWfBOKW/KWjIC8pD4vvN2Le:3bkOf0TdcMFs/d3f5jgW3B
Threatray 204 similar samples on MalwareBazaar
TLSH F4A3F826FAE0BC51C74144FE9E2446A82457FC70444ACB4FEAC77A6D09FAA93A035377
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EMAG.18229.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 16:12:19 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
12e01498b7e13b32762590b5b20c5310bf388ea837dc52323dc9bc90de1166f6
GuLoader
4ca3ae0f9b573739e66192f15aade1cf3d409ef133a7b6834ad4e387dea498a5
GuLoader
7391f3917523baee91e92967c12e20c57448474696590fcbc6e5e6b3c5e21f78
GuLoader
8542bf1c3c7532f11fc39b4b6a20a08ef5bd0c8d42e3262028d4ffdbc5aa88f8
GuLoader
8fb2b9dc001a9dda1b56963034f4957c33e13cf502ab963630100350c0143bce
GuLoader
8fc4747ee4e9b358ddd1dffff19b0b3f5166e8b4ef15257be68d3fa2decb347e
GuLoader
a2bf3f45bdc745f100e74e154249ceccf3339a09de63ebd1118b50ed7a305a9b
GuLoader
af6af9c2d50e7c692521dac219b7f2f23c6b677216267dcbaf44bd44f7290d70
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3
GuLoader
+ 194 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-yrnngwcyga/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 73c6461867083483568798834d7f557a61696d61d0eae801e95977f2704a5af9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/364961/
  
Delivery method
Distributed via web download

Comments