MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86a315be4e708db92a2991b39cadb2074228c327640a26e019325294eeb1bc3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86a315be4e708db92a2991b39cadb2074228c327640a26e019325294eeb1bc3a
SHA3-384 hash: a1d99e9cc07e902343dd6a4c030f27071bb76c0cd5c8fc413237028127e4b8863afa246837ce575a3efdbbd08c21a3b6
SHA1 hash: 8667fd719e2d9e9b72941da6a0c9eb554f947e27
MD5 hash: d46a04aa0197290c5c7eb37e1afed5af
humanhash: mars-orange-chicken-don
File name:Order.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-05-25 13:40:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f4a42b707f646e8f571bbfa7f4cce412 (1 x GuLoader)
ssdeep 768:MkpCKZrim/kQmhatdOiJRaRk0lZLE4fS682jw460CagvpnHjiHBOdQsW3w:3/YqdOinaRg4Ke8CCagvZji8dQst
Threatray 1'558 similar samples on MalwareBazaar
TLSH 32B3092778D8DCB2EA318EB18EF087A01E277E291C534F437499B35E15771856EE123A
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5569/
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:36:47 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
guloader
Create hunting rule
Similar samples:
4b610516f134b6efb2100a2e298a70b573be1cd6c4d653af007b907f11ff065e
GuLoader
5a30aa9032bf9eb86209f176404481e70fa108b689330a2544ce0b54fa959ab4
GuLoader
6ba2ab2afade3c48fb86ce5290a0980f19e901117033cb723cfd48b3ab2c6888
GuLoader
8b791216101006bea031bc4ff657001f95cd58ed1db4429a242d79050f947d40
GuLoader
983a50787533f7fb48c7aeccfe0cc8ea3b16a76a39b22a1668ef800ed56556f6
GuLoader
ae6a500ab45e86279c34a92c49d12f73716f0a492075180cdad48a761bf38b49
GuLoader
b666f8a605a45edebf5a3980675d00b84343a9b3c7a6d00fb90c37f40b55ac57
GuLoader
cebf765590be725ca5f5589e51a0e81236f6e63dae47f1cdff6029429827c0be
GuLoader
eec46d65be09a86f25c891d462671a7a0b3140ee4a8a6ac0a9fa7e1c56a8cb40
GuLoader
f6acfb0076b3a4e817b12f1f4e91eb89dbeeee1bca29d591949b73dfb604ef68
GuLoader
+ 1'548 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-lg3mbd9v3n/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 698784575fceda6d633015c344d680e495f02e2451ea64ba0225469dc0053d06

GuLoader

Executable exe 86a315be4e708db92a2991b39cadb2074228c327640a26e019325294eeb1bc3a

(this sample)

  
Dropped by
MD5 d4a1963d94aa7ea21ece21538abf5f77
  
Dropped by
SHA256 698784575fceda6d633015c344d680e495f02e2451ea64ba0225469dc0053d06
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/5569/

Comments