MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 969a6ae609d48434fc77838a81d18bd5b93363cea8c1035cb84c091592df8789. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	969a6ae609d48434fc77838a81d18bd5b93363cea8c1035cb84c091592df8789
SHA3-384 hash:	c682b5ae7690938a12d2adc16fb10cd3bf08e2d40c8889e64f96ace8b09a20d510984347e108567b2e00bd927e94dad4
SHA1 hash:	ce42bb028927d6cd1cf2f3c0e48e17bd7b66440c
MD5 hash:	9715efbccd1ca64197595d90166df7c2
humanhash:	victor-mirror-bakerloo-papa
File name:	Our Ref 0050052020.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	110'592 bytes
First seen:	2020-05-05 10:44:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f1bcae18365b160f13ff1a6264e428df (1 x GuLoader)
ssdeep	1536:Jt8iIKV5HDpZHtykQh1J9ZuDhSuxS5Ia2Ic8PCHAUWW:IKzNHQDJ9ZuDhSuxZ+csCpWW
Threatray	142 similar samples on MalwareBazaar
TLSH	EAB331405AE5FC1AE8A93AF2D735F09DC7806D35A875721BAAC1724E5F384809F3076B
Reporter	abuse_ch
Tags:	exe GuLoader Loki

abuse_ch

Malspam distributing GuLoader:

HELO: imailtoolsbulk.top
Sending IP: 117.50.3.249
From: Sales Representative-Wire <sales@imailtoolsbulk.top>
Subject: Our Ref 0050052020
Attachment: Our Ref 0050052020.tar (contains "Our Ref 0050052020.exe")

GuLoader pushing Loki

Loki payload URL:
http://castmart.ga/~zadmin/xcloud/apslo_YtEvxbIn153.bin

Loki C2:
http://allenservice.ga/~zadmin/lmark/ap0s/link.php

Intelligence

File Origin

# of uploads :

# of downloads :

100

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Siggen9.44485.26724.6720.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-05 06:55:28 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=s2ngvzqj2scdj7dxqofiduml2w4tgy6ovdaqgxfyjqerlew7q6eq._file

Verdict:

malicious

Label(s):

guloader

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-jc2l37vka2/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks QEMU agent state file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com