MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84dd753eb32401aed1b0702e7c52c7d9317fd55c26348b9b2a64eae4943d028f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84dd753eb32401aed1b0702e7c52c7d9317fd55c26348b9b2a64eae4943d028f
SHA3-384 hash: a11110a6177644cb335a7b8f2bbfd9d22be90e30ac3f5faa654a30c4ec00aa4610e8411927242244ddb3ae4368fb0600
SHA1 hash: 50e5b40fece5590e2394534f8a858b764501bcf7
MD5 hash: 98bf56d8190f8ccf92abae690ef1e5aa
humanhash: colorado-avocado-sierra-indigo
File name:SecuriteInfo.com.Heur.PonyStealer.fm0@B4imZ4kG.4310.29637
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-14 15:50:45 UTC
Last seen:2020-05-14 16:41:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d7b8b61258c73e8a4339855ec6d03574 (1 x GuLoader)
ssdeep 768:M0ktdGpyoXWfapKmvnP73YpSyUX/puP+AGipZHEZZ/Z2E:GtdGpFA27oSjp/AJXEZCE
Threatray 66 similar samples on MalwareBazaar
TLSH D6931A34FAC0E121E52486F12ED693E9257ABC311D51C9073AC7B75E3A36E56E53032B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.PonyStealer.fm0@B4imZ4kG.4310.29637.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 12:02:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0353a90102276045a708f151d0d4c6e1e3008e0de89b33ffc1329d0034932e28
GuLoader
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
GuLoader
8a6358426543c2a66c3bb116cf5a8cdefa04ba41463c4c05363bb03521f860ee
GuLoader
a3c2207806f9be710f3a1d1cbf1149a708bb080946e2368c8e826f5cef2293e4
GuLoader
b18dc8d2a804cc717ed7e737b3980f4e236fe9f81521ca815bd7161b0fd3db5c
GuLoader
ba7a2f7a10ab469e949866d67876704a9c8164c41e29915c46ef374369f7760b
GuLoader
be4c2083b065f457197a64c7192cc7f679a53e53737de2f64c41403170434faf
GuLoader
c90c7a5567f9db6866c7028e6dd1da3bbc962c42e5fe17f393fd3aae6c7d63d5
GuLoader
dad750195d0fc6695caaeda6ae16fe7131fab602fbc0b412e8a14703e0664788
GuLoader
fcbcbc48c784b9238ca42b16ce377ad3b3dd9db06cdf7460ce9e6db2debc3d60
GuLoader
+ 56 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-7pe2fesq2x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments