MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8077b9d3b809c1b66793e7292d7afdb401efa60fe9be607bb48a30bcf005af06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8077b9d3b809c1b66793e7292d7afdb401efa60fe9be607bb48a30bcf005af06
SHA3-384 hash: dffd2c22dd44dbcec9a3a7abae45291016ef5629365e1711466ff1f6047dcca34c17779b72228f473d5e6bcaf3575d33
SHA1 hash: 815bd9b40f26a57b333b647a172d04ade78ffd9b
MD5 hash: a01fc01d5b77c851d8d9929d5a75e4ec
humanhash: hawaii-ceiling-asparagus-video
File name:liturg.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:143'360 bytes
First seen:2020-05-11 20:40:21 UTC
Last seen:2020-05-11 21:49:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 718f72bdd53ac72bc6f0c8607ff26949 (1 x GuLoader)
ssdeep 3072:+EEbfBQ3j8t/liTFwWVZpP9fE7Y3sFwpZJpnF0htbYxp1TXe37VFaw:wBQ3utiTF9VZl98LFwpnpFQtbYfBg7V8
Threatray 774 similar samples on MalwareBazaar
TLSH D7E33E948B98EC17D45878B2EB82F95DD3942E35A832621373C0736E2B39591DE2137B
Reporter c_APT_ure
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33789012.5744.8538.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 12:04:35 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qb33tu5ybha3mz4t44us26x5wqa67jqp5g7ga65uriylz4afv4da._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
025ce893661f87afc7352a9f89403e337a4e6d982ef3d97cf19e74674cbdeed3
GuLoader
133b27bbf63dcf79d89bbf8b46be58d0219323be3d3e428f5e1c7feba7c55f89
GuLoader
3a842ce737983d2dfbdf7974d30373cc0880bf054af84284d7a065ed3548f43b
GuLoader
5da6c70f145dcb4c50abe95e6b641d3a4c24fbc74f02b19aa40e574b25eaecba
GuLoader
5f9b8ce62abc0d49b1bb253bd51286151a8b3d3f09fdb9e37cd964f80df26669
GuLoader
7cfa97a92b4242af9657fe87263b30a68d06f7d360c565f362794618713e1774
GuLoader
a45d9c8d3f5ceb809b8ee497e806d29d6e379ae0603aea8b733096afcf86bdcc
GuLoader
aa3420190b3e22959cfb4715307027404fe5cb492faf5546189a20b82b9e4e37
GuLoader
b1d1654f14052fe13960bbde4280f2f1d34e802293dddb47c971ce833bb5bda5
GuLoader
c9dae8af9343e2bb59a9c6cbfa04b09bcbffe2a75893d797ec2a9c50c6253afe
GuLoader
+ 764 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-wk9kjd9qrx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments