MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 79a2240a25ae035c8fb372974e643f276099d86118d018bb6053571cc3d06ce8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 79a2240a25ae035c8fb372974e643f276099d86118d018bb6053571cc3d06ce8 |
|---|---|
| SHA3-384 hash: | 5196dc5375975801942c391e8d9660bbb8803d8be2465a851cae5b1044c0c04280466bd55ad37ab9d2d98c349c159633 |
| SHA1 hash: | 2c150fe7bdf5a9f59e910a1c531f723fdd29fb8e |
| MD5 hash: | 04945438123f51fda1aecf05e2597b68 |
| humanhash: | carolina-venus-comet-violet |
| File name: | Product Inquiry.bat |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 106'496 bytes |
| First seen: | 2020-05-18 14:02:11 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 31a5a1336ba64e754ecbc8a74c608685 (1 x GuLoader) |
| ssdeep | 1536:GfkVd8EeXc45aF8viwbZB9Q1KukFzVNFx7Rgmu264oYOf:3j8EeXc4yVKui9yf |
| Threatray | 1'286 similar samples on MalwareBazaar |
| TLSH | 7DA3835073A8FA27C8658EF70711AAE601F85CB5981076136BC77AEF1639C76E27031B |
| Reporter |  jarumlus |
| Tags: | GuLoader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Status:
Malicious
First seen:
2020-05-18 14:35:46 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 1'276 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.