MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fbf35d50ff9c5631faa962161cfe604cdf8860472986bfda7942131f60b6e13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fbf35d50ff9c5631faa962161cfe604cdf8860472986bfda7942131f60b6e13
SHA3-384 hash: 89c0f6c83360302bccaf549cc49311c9fef519df0032c90c6cda22e71a0c73bab9ce974244075d9dcdfa3a8661d99759
SHA1 hash: c93a666a02a25ccfb7ce61f670a6cd67c5e6a122
MD5 hash: 2e97bdb508784f1ee9eaf5004a7f3c49
humanhash: kentucky-foxtrot-snake-oklahoma
File name:2e97bdb508784f1ee9eaf5004a7f3c49.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2020-05-21 08:41:06 UTC
Last seen:2020-05-21 09:51:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 38873f6030d787d674c3f945a74bec12 (1 x GuLoader)
ssdeep 768:scT7tqLC8fZLD7kNsrCO82sBQfAslooLejA:B3tqLCYlfkNsrv82suIoLUA
Threatray 64 similar samples on MalwareBazaar
TLSH 9BA32A21F2B4EC32EB4A82FD0E524998536BEC344926C94F73C7B7AD25F6581E618347
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=13cZkt2yspyodOvLYb8JJB8iZnZ90Sh65

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47944.8084.22781.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 07:43:04 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p67tlvip7hcwgh5ksyqwdt7gatg7rbqeokmgx7nhsqqtd5qlnyjq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1d452b5f3e5d2b6623d0ca35793dfc051e1bf8b237e360906ed055e819235604
GuLoader
3304692b98947be42789e37a03aa03804b66df6235cc20d8611d7aa42c27c7aa
GuLoader
563ee97396c60bb7d587d98e95d68109cfe9b0a924860bee678e1e4da196bb64
GuLoader
a4429d0165e0b0c5e3b7840303bed826a9de8122d824622656d9ae9d6e396eea
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
b624f2628a187644b398db22269d178207461ea7180bc442b3623a0ec67d35f2
GuLoader
b7e415a16cfc8d84c09f105709910d808f0ad13e64c7feb4169b135fe57c7f99
GuLoader
d710447b99c5d26cac4643f971557e7d1b792010942ec3a4fc43ada5c02317da
GuLoader
d8dbe0a74ff4d70f5633f8177f37c14cd1586d7a658ecf72d05f59261e8ad016
GuLoader
e0a34b9c420ddd930b3f89c13c3f564907dd948e88f668a0fe55ce506220bd73
GuLoader
+ 54 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-k9na2yps2x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 7fbf35d50ff9c5631faa962161cfe604cdf8860472986bfda7942131f60b6e13

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/365786/
  
URLhaus
https://urlhaus.abuse.ch/url/365213/
  
Delivery method
Distributed via web download

Comments