MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88b9016ca27b117830d0551458312126f49feca182dcfbc8f4f5558c7fd4fdc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88b9016ca27b117830d0551458312126f49feca182dcfbc8f4f5558c7fd4fdc1
SHA3-384 hash: 922b956c1e1316f2716d35753f05abb0acdf71587748d096edc7264f5de3096f7da9cc3585859eb0037d8b3ea47148cf
SHA1 hash: a40512ebae970e3cbe3362804298301f967ca0bb
MD5 hash: 77f91362dfd87a0a8cb4daf402c301a5
humanhash: vermont-south-football-freddie
File name:77f91362dfd87a0a8cb4daf402c301a5.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-23 11:51:26 UTC
Last seen:2020-05-23 13:13:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 10600f63092fae94a89ca78bbe36c574 (1 x GuLoader)
ssdeep 768:BhYO8tCW8G6yRoheYvQgKlyCVvDF4ZH1VUegJYD0jmHdI/Y8y1qYl:bYeJGKD5K5VvDF4ye6YMXyb
Threatray 53 similar samples on MalwareBazaar
TLSH 43931822B890ECE5CE248FB26B379AF41527BC302E142E4731F97F1D193658D69A6743
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://45.143.222.30/Frank%20May%202020_PDyqE221.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33888026.30496.3666.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 05:12:36 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
00983a8176276beea115d21fef7919c49b29b96d78dbc2151cc04cc7d8c95b35
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
1f577a72bdda8e2504e3ab0094e129efe0c8348489c5c4baf9beae2fa5cecaec
GuLoader
443bc33e9d28fddd4229367cde23085b8d57549093ce8e991eb4753ce58c85fe
GuLoader
4d02a7969e34cdedb37997496c951b9e37f40eb8228deef6e436a3781ce00966
GuLoader
83acd77bd1b76095992046c1cd53fd0fb4f0ae9f22f410facf174f4e1ce2f475
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
dda25996ab5b78fa63ab71aa304360374fe2eb6ded670c778b2c69d9fa1f1e40
GuLoader
ef8f03a25087eeab581d8439a0a19ba7148270d2210d479c1d6867fac69dc813
GuLoader
fcaa4b93dbdb7ca43dab06e0afb63117ca21a864f7ccf6f6eb7a4581ded48464
GuLoader
+ 43 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-5dczksh8v6/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 88b9016ca27b117830d0551458312126f49feca182dcfbc8f4f5558c7fd4fdc1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366578/
  
URLhaus
https://urlhaus.abuse.ch/url/366577/
  
Delivery method
Distributed via web download

Comments