MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96e695effa7be570f49f665ad01907c413443b0f51fdbec6372d2ff7c9861d72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96e695effa7be570f49f665ad01907c413443b0f51fdbec6372d2ff7c9861d72
SHA3-384 hash: aeb5aa7b98db67d6a177fa9d95ce07627eeb5278c61700eff0318171b208a4d3f0b34f6e473a608391d0a478ea5765c0
SHA1 hash: a3d6d15933262d1592c0f77454342cad69fc58c8
MD5 hash: 6661efd9eeeb973e07922e3cb5d4d0e6
humanhash: california-high-quiet-twelve
File name:SOA.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-09 06:27:02 UTC
Last seen:2020-05-09 08:03:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 12906ef6f70fa32813e55ed44a4aab3f (1 x GuLoader)
ssdeep 768:GpLgeFnnmRKOUL2lv+EawFl4DKRRfEJ1HvscqS9UaRiUm4ATA/urALRjs+:GNNnmHU+vDmDVsc/WUiUUA/ugY+
Threatray 598 similar samples on MalwareBazaar
TLSH BB93B6C1A3E8D02BF6AD09B26FA0D29855A1BC317C25DA077BC8774F19359D1E260B73
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 21:42:19 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s3tjl372ppsxb5e7mznnagihyqjuioypkh635rrxfux7psmgdvza._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0a48a4027eb05b188d2cdb83f220a3160c9b5c9006df53306bbf5e4ad9ec55c2
GuLoader
0c780ce6cb4281a12cf329e18bdf36b987e34dd15379a4c2f6f8e03ba56e13be
GuLoader
34d5bd380c2902b64435c9e3cb3a917b329cdbde53397cac6ec767af3904b2f6
GuLoader
409b5df63705aabc1454bfe5a37b511cb6b38e10876fa39fe2609bc05d8ac169
GuLoader
498fbde70a7375ef095b51ad4ad72798d26a2d28dd82e155e9afc31e95773bea
GuLoader
51b2fe7ed5d6da110fe512ac143f26b29b8819b25f4540e93825d310d60d2511
GuLoader
7308b321667d579fbab79329977c8396721f9211be62b99b3abb3ae8e49dbcb4
GuLoader
78cb6053d76d453fb3885f47c1634fc28e20862a5a73bcdc1557e5620ae7416f
GuLoader
b42bb3af52ae6b9fc8dd890fea86abad727db5ae0647217d2f5f2035bc5c2c7b
GuLoader
c60f1b4267812d2650795dbc1df35f5bd590bcd24253a7fcb580e7c961b9523b
GuLoader
+ 588 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-y8kgrhpyxj/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 3aafd0e5dd321da86f2761bb642c49003bc486cdbbcc865fe74ffcb2c935e588

GuLoader

Executable exe 96e695effa7be570f49f665ad01907c413443b0f51fdbec6372d2ff7c9861d72

(this sample)

  
Dropped by
MD5 f5eb87ef62e0818adfa186fd74e91dc3
  
Dropped by
SHA256 3aafd0e5dd321da86f2761bb642c49003bc486cdbbcc865fe74ffcb2c935e588
  
Delivery method
Distributed via e-mail attachment

Comments