MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f4147785131b1c4e30710abb80aa3184ce0d070a0bf557a633a8a0eb8d1a77b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f4147785131b1c4e30710abb80aa3184ce0d070a0bf557a633a8a0eb8d1a77b
SHA3-384 hash: 9fe2b48ff9c47975f536cec23bb9f857592441625d6fca7c1e7ecbc8d12d3c798cafb79e5e8412d54f85c5b3c370c858
SHA1 hash: 58837aca00465791f4e7602f24590f2c972b6287
MD5 hash: c397065e107a81085ae48173f6205e53
humanhash: two-green-eighteen-item
File name:Shidebg4.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:81'920 bytes
First seen:2020-03-20 06:21:52 UTC
Last seen:2020-03-20 07:32:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a179544afc23670b151f49c2bbc43124 (1 x GuLoader)
ssdeep 768:AraGPG7FFtim4IfT11aZicvNQvLvmjmXPaL5D7mlRVq6KDBNonCMRCkNcM1A:ArXuBjZ4Irjx/aL5Py3KDcDAk+P
Threatray 1'916 similar samples on MalwareBazaar
TLSH 43837C07F760F426C415CB7D3D0AD6D0116BFC286E51DA8B36E87B1F68F10A29E9D219
Reporter jarumlus
Tags:GuLoader RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.42865516.27627.19608.UNOFFICIAL
Create hunting rule

Win.Trojan.Vebzenpak-7639767-0
Create hunting rule

Win.Trojan.Vebzenpak-7640209-0
Create hunting rule

Win.Trojan.Vebzenpak-7699953-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-03-20 01:36:04 UTC
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r5auo6crggy4jyyhccv3qcvddbgobudquc7vk6tdhkfa5ogru55q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
guloader
Create hunting rule
Similar samples:
21c0f71a640ec97eb4bf4e3445896f1200e676bc8c2c096db8a725d5eb6f3427
GuLoader
2d29f962b325477d0a35364394c3ea6178f7b030e7a4e57c3811ea3696b7d661
GuLoader
6c62bb193f11ea8626c9c37f1898885271682c15f4bd8d8a7bd7a52fbd67c54e
GuLoader
76ad37d1dc734c1ede800c5cc7e2459dc0a2aea8347b25ea609af6c299da5a78
GuLoader
84a066f7294211d47a88b38b0ad9ff2f0e385973c4a3b92b39b2df25e178aca8
GuLoader
92f26df2b8881b2971127cc9bd67d17924b895e4124092d49fdc6ebe4d362620
GuLoader
abee232f81ca94abbdb0d1c0d236b0ee49b421b32e0a6b8812e278a248b6b46a
GuLoader
b8a03fd14b3a3695af8b6c781eb946214a98986279678c6b2a477f22ba1ac3cf
GuLoader
b8d1d962744d0c6ab3abe293c4671b3ba6524f623f9d6f02361bc60eec7b4cb4
GuLoader
f18bf944f9365beda201e63d97f1b93139994d9cef424f855d691cf797c33d0f
GuLoader
+ 1'906 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f4147785131b1c4e30710abb80aa3184ce0d070a0bf557a633a8a0eb8d1a77b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments