MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 893348cfa61e59048f8444685df09b3f6dcb22b84995427ba4cff095ee53896c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 893348cfa61e59048f8444685df09b3f6dcb22b84995427ba4cff095ee53896c
SHA3-384 hash: 8382dfc12bbc2c2513d80ab84fe9db09f78bad73689f177121e05f5f12eb3970b72e53b69985e2ead610895a7e1e8611
SHA1 hash: 916bfb9eb5b4d1feccc1c32942028106c895ea07
MD5 hash: b52b8a86362e589daf1785914d44b042
humanhash: table-cup-tango-green
File name:b52b8a86362e589daf1785914d44b042.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-06-03 13:10:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 712431b4108552facd4b84f9b6b26dbb (1 x GuLoader)
ssdeep 1536:JSPfxV408H+fdkgrKHxLdGKc+o0FDHdZ1gIcdW8MVJrfgKpc8NDlVD:cPX8H+fFKVdhjFD9zbF1NJ
Threatray 901 similar samples on MalwareBazaar
TLSH 32B37C17EC4D8A13D2488BBD2D139EB93A1DA90D0D409FDF71796E9BAD313422C9B11E
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://ratamodu.ga/~zadmin/group/pm_FBUoVd204.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Pony
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6298/
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 07:05:42 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rezurt5gdzmqjd4eiruf34e3h5w4wivyjgkue65ez7yjl3strfwa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
17f52dbf63e20cb471e6da579551830186446d814a14162ec3569c62fb6f0771
GuLoader
3e3529db8cde73fcdb792f6414ebe6fb9a6ec5ba5cf5f503376a795387b2020e
GuLoader
6ba2ab2afade3c48fb86ce5290a0980f19e901117033cb723cfd48b3ab2c6888
GuLoader
7d110a4f6f206b5fb49742150bdbd7ffc43b29a5b2fa32424ef32aa20c4696f8
GuLoader
87f0608e17f3f39e988ac186a431366e1de35968b89943a03f6681e23ab5b684
GuLoader
97d8ae62cb751e857b04d9eaa68ee2acce3d7243009bdb04639a729cdfc7cbf3
GuLoader
983a50787533f7fb48c7aeccfe0cc8ea3b16a76a39b22a1668ef800ed56556f6
GuLoader
ad8132d2a341bf731c105eed4dea2357f5ab516c085550294593a2e41f34ebc4
GuLoader
f0904d56b0d621156adf1d4449d1b445e6d45eec9c0a4b09e22f9bb95a185955
GuLoader
ffa86315bf2626a0d898bfb87783206ab4cb64b9b4c645661c644f717052ddf9
GuLoader
+ 891 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-61vgjz5zdj/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 893348cfa61e59048f8444685df09b3f6dcb22b84995427ba4cff095ee53896c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/373113/
  
URLhaus
https://urlhaus.abuse.ch/url/366100/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/6298/

Comments