MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93094d62b24b020cc2b39482466e3df5a172d7e35b03fb4dadb120fa1f238fa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93094d62b24b020cc2b39482466e3df5a172d7e35b03fb4dadb120fa1f238fa0
SHA3-384 hash: 326a3f75435817b0fd8821c3a9c2d4c708f6758fa37135377b96aa4e52e1bc3f658707385d3aeb660a4bab2cfd5572a2
SHA1 hash: 9e51336f6aa714ec26bb633c318d5d2667e09802
MD5 hash: b97baa1f662f65396d1dbf5c96bf46e7
humanhash: fanta-may-arkansas-stream
File name:SecuriteInfo.com.Gen.NN.ZevbaCO.34108.fm0@aKrQsaG.12555
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-14 12:46:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e618a98c72839a9954f5c1b0c35c53fe (1 x GuLoader)
ssdeep 768:kXHhVFyjPNKcc1o7XApSEiXWtrP05M2Uw02V:sUPwcc14ASAtD05dTfV
Threatray 53 similar samples on MalwareBazaar
TLSH 9F932A35BAC4D162E618C6F02E9192FA142EED305881C90B3AC67F6E1E37E66E530357
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaCO.34108.fm0@aKrQsaG.12555.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 09:43:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=smeu2yvsjmbazqvtssbem3r56wqxfv7dlmb7wtnnweqpuhzdr6qa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
37badb60f9862a09e36f6fbad57f97375fccf52cb00dfd2415e5887031753be1
GuLoader
6cf91b93dd7a3a6aca9878a5cf252af90000628486161243a086d6477d5d1f04
GuLoader
77168234eb706333e4835666a00a8fd8e110959660c97e5c5528ed3a3d0f5081
GuLoader
9f7bac168d783095c28bfe48f9ff40079fde45084dbe9aac78eefa54c4cf15ff
GuLoader
a50e61518bd6d7d992ddd12e25cf7b0e190354c8de9043d201161757424c59a8
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
dec9d864332aed8fa899cbbfa85ffb4404744257be8c7bd8ab0a6464df226acd
GuLoader
e571cd3a4c0744cb3c5443b868577adced331a7545fcb6e2ed0efbe7506a2f9b
GuLoader
+ 43 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-fvj6phwbcs/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments