MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639
SHA3-384 hash: b261f0fc22326f1caa3570c2978767c691df7526040fcd2d07b6346cc2d1877d84efe105259b398a2c9491b7be0418f3
SHA1 hash: 15652c5110b51eeab7d023d75a4337de84ef7528
MD5 hash: 145dc1bfd96fb13644e764d0032e6c4e
humanhash: zulu-grey-helium-bluebird
File name:SecuriteInfo.com.Variant.MSILPerseus.225130.3026.7575
Download: download sample
Signature GuLoader
Create hunting rule
File size:891'392 bytes
First seen:2020-06-04 17:37:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'654 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:YmAHk6UJ6rxYB79mbL0RHdGr4UNZiaepiVnAeybxDgue0KurYvGfq6Cf9wuflCfw:YmAHk6UJ6rxYB79mbL0RHdGr4UNZiaec
Threatray 828 similar samples on MalwareBazaar
TLSH 5B15F1043690AD4FC27E4D72D96618109B70E267AE4FF343ACC725EF582EBCA4A11797
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.MSILPerseus.225130.3026.7575.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 06:13:11 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
05a1757ef9a9f8c23ee672b561363769252e8d6c8f7d739934e763ef079e0932
GuLoader
1052af46484d7951eeeeb53dac926cc6a823bd324538950c48dfc4b2b35f830b
GuLoader
2c80f61e5c61bb87be9e2d60e69093bcb5082fc690fcd751be787dbd118d5e57
GuLoader
4aedc1ecfe84e885ec6021198dbb729f438f9f058fb2363a09512cecf776c975
GuLoader
7294bdc3333d08ac9c2397b3555c0126928c13600b23de09f21841cfee83f55a
GuLoader
7d02ae5ae3ed3b7a13ff5495174216ea3195764d7154b8e9b4997c74fd08fb09
GuLoader
8aa7a5eb1247b0d54b2bd29dd6b2d563ca30da4990c8220f61da826fe5941452
GuLoader
a03e9689d30d9691f4b2b86dd2c53b072ed290efdac0f6b2230fc445cbe8f26d
GuLoader
b30f264fda73db6970c313776095289e5fc0ee77f6be19010e2f9e125205e845
GuLoader
e04977f7d1fbf8b3a69237bbd2170af6c3046a8ce29e2732cd7c72f079f0e0f8
GuLoader
+ 818 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ejyca2wzkx/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/379463/
  
Delivery method
Distributed via web download

Comments