MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 817912d2ff7a320b0452ce4777cfd47db43d3b71be8d5c937ee5959e5e2d537f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 817912d2ff7a320b0452ce4777cfd47db43d3b71be8d5c937ee5959e5e2d537f
SHA3-384 hash: 1b0463a1b9fa8cf2d040d833d1008237df0724131a1231625f895a52fe4253742590a72f5e82ca3a8ba8085e62379b2f
SHA1 hash: 639d0c8c1af0112808be4df486c1d1353fce4d90
MD5 hash: 88bfdead093c7991cd64af10a404f52d
humanhash: mars-solar-enemy-south
File name:88bfdead093c7991cd64af10a404f52d.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-21 08:32:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a60b0d485ab84aaa8bef006c2f9f491f (1 x GuLoader)
ssdeep 768:/BPAhQfKZuSsgO1x3+0yW5HBksBn+Jq3jCwgvy+YPL7o84ONiKva2Kehi:JoR3tsx3+0V5HBVB9V0TV
Threatray 134 similar samples on MalwareBazaar
TLSH 6D933B22B2949562E7514EB0DF38DBE812EBFC312A044C073AC57E6D5F77945A22237B
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://learnteachweb.ru/ikt/filter/algebra/tests/test/dan_GvrPllsPq120.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-7788440-0
Create hunting rule

Win.Trojan.Generic-7789322-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 17:31:50 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qf4rfux7pizawbcszzdxpt6upw2d2o3rx2gvze364wkz4xrnkn7q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
08f3b51c8493c5ed8948ab35c956a465e0043094248d2f27a5d8fa9a696e3cbf
GuLoader
278593e60722d691fe1b23b22cab15294662bbd2ef8ca1ba8e80ca78e872a813
GuLoader
302b22ef958f04eeef47eaef2fe2d2fd062a17c16683ec8f2cf0b899f19c2acb
GuLoader
3700f2c5fe27c80e41984b2a55f236655a09f0781c05b265bccb26165318d78a
GuLoader
4e14841c96a09f5850d1cf5fcb3526714c22d7174e3f75c8a309d8db36ecef93
GuLoader
5bd66c88148005029d20c92e1d793f8d41f47a273a9334f9a85ec31148d0b040
GuLoader
8d1b83eff1b3c604365fd29de1bb43204852de842c0bb148975fe7a7485310e4
GuLoader
927a8d1445750400db3850d0b2dc3522b0f373098385373efa3d7762120f3689
GuLoader
edbb90a8091fdba91b1ef2edfcc457e7cdcf75354a9483a9b79907876856b579
GuLoader
f3ba5d0b27ff406dcd1c624aee919f394d231b878f040ec23e36c7f0cf81df99
GuLoader
+ 124 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-7w5ele5yxx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 817912d2ff7a320b0452ce4777cfd47db43d3b71be8d5c937ee5959e5e2d537f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/365917/
  
URLhaus
https://urlhaus.abuse.ch/url/365927/
  
Delivery method
Distributed via web download

Comments