MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96568402add3b23971d79fa6730a1bd054509512e1d73cefec74c307aa46d436. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96568402add3b23971d79fa6730a1bd054509512e1d73cefec74c307aa46d436
SHA3-384 hash: f722a314bc750c6e8816b69225e6d807175283881daa61f939ad0f98fcbb8fd1504616796b1e123ae9091d037c9ce691
SHA1 hash: c13f2e7d76ead6c0ab4acd86ec0ee06e2ffc8b10
MD5 hash: 604cfd460f8a0c116cd9f6f0ed1a2936
humanhash: princess-crazy-iowa-gee
File name:Invoice 56020xae.bat
Download: download sample
Signature GuLoader
Create hunting rule
File size:126'976 bytes
First seen:2020-05-08 18:32:50 UTC
Last seen:2020-05-08 20:01:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cada34ced53ca6abd427fd5cb049c107 (1 x GuLoader)
ssdeep 1536:2lia6K2dhmBKzvTDyeFj8kdIlTQKu70gp8Qbqy9j7M0K8kO4X02KhTvmw7U:2caBAzzvXbdKQ/70gqHyx6VOWKhX4
Threatray 204 similar samples on MalwareBazaar
TLSH 26C3808573C0F697D5E80EF2475A83E115F9AC3A7D852B077BC9B11B6638A41EA20373
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 16:52:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=szliiavn2ozds4oxt6thgcq32bkfbfis4hltz37motbqpksg2q3a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
042359241a3a3f4d635527751c2268cc80121586dc68c9a6732edb20d25ce760
GuLoader
1240a7ff417004b8b3b98ce0d7adc1f959178e730590b45b2cba92c473fc0b89
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
4c567d47335c4c7a99133643e137e824203b8958b44e1c8a0aaef7a6aed39cf1
GuLoader
52f137c22685d15df043daabdb9c823e07ecec4df42bcc2fa2c5bd45913d32ea
GuLoader
677825d1c55ffae0ee20b966bf6e7318fd6e0ccbfa1c65a1c42d19997fcbfc06
GuLoader
9532627f43a3de7b9c4414517f18197a08969adec3c24e1c2f1856e32613d5cd
GuLoader
ac4035cfb9c8a93c294fe1911bd4cd94ce403d8cdc301fa4bf113144b40d1245
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
e6ff6d164a876c50bfc4a6f7b6397914f9656d0e4aef1ceba65f1e92ed1b6c69
GuLoader
+ 194 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-1m54hxvc3n/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 91b5807df902ddbfe312194c46a6939e9f636354682ecffbd76aee1c96fcbaef

GuLoader

Executable exe 96568402add3b23971d79fa6730a1bd054509512e1d73cefec74c307aa46d436

(this sample)

  
Dropped by
MD5 21666a7e470bcd42688a1f9b5be9d0aa
  
Dropped by
SHA256 91b5807df902ddbfe312194c46a6939e9f636354682ecffbd76aee1c96fcbaef
  
Delivery method
Distributed via e-mail attachment

Comments