MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9848da60b74c19523583a237900008a3fcb268a9a4000c352f944f7d9f0d78e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9848da60b74c19523583a237900008a3fcb268a9a4000c352f944f7d9f0d78e3
SHA3-384 hash: ad0ba2c606c289e3b1570dc96146207c87873675418037496715aa5c999add972d677393a327c2a7e43366ad668d553d
SHA1 hash: 981ea9a8639591cf821da7ca0eb97f7f640cbe89
MD5 hash: d5399017db0dd2b3ab91aff107faa44a
humanhash: ten-blue-batman-magnesium
File name:d5399017db0dd2b3ab91aff107faa44a.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:114'688 bytes
First seen:2020-05-27 13:01:00 UTC
Last seen:2020-05-27 14:13:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d98081f2a1e4f3103de5ec6e323fa358 (1 x GuLoader)
ssdeep 768:ENLXM1xmu2+GEyFvMFpZtRxyDtvaAeUB1VDISnNkq3Kl+9fF0I0LHykvKxLRO4Yk:SMmgGtvM9xEDzkGo4+I0xKx1pPD
Threatray 501 similar samples on MalwareBazaar
TLSH 0BB307177AE19CB3EC708BF12D7585659C32FC387D141F037580BB6EA5BA5CA24A036A
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://45.143.222.30/Frank%20May%202020_PDyqE221.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5711/
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.50060.6822.3401.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 07:11:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
13277d505db31b33c1c62936da1cebd942555d66b1a74edf5a44336d62117221
GuLoader
1d4bd4bcfe5f31f317eabc6780b91c1499f4dfc22025cfa6eeec3bc188207dc3
GuLoader
242048a88fe7eb08cbd3de9cd13d0dad6f532bd8f85fdd8dcee59d7289f6c9ab
GuLoader
2a4737c791956f7c020af62490a855297096797a632a39e493ddf19365916456
GuLoader
4dce60ed857ab264ba4db32dfa8a3f4b3e6cc1d94cb2cb48bd33a98f9bf9f692
GuLoader
70399b135fa0365dae66a01b072dd8614be73c7ff2b4cc51caeeef64dfc60ef5
GuLoader
84f409f8aee0cf253fba68ae4027348449045f7bfb8723ac8fe0336c21c0b0f6
GuLoader
d44e6b767f7bc663a04cb2e952e202eee52f0914a35115fa8129cee1228a31f3
GuLoader
e63df6a7f5c2a30456c884959644745ee0174df416492324c5ee31635958f855
GuLoader
fdee0aef0be932935554b59899df6f51b2caea4d730ca1179158c15f62a9ccf4
GuLoader
+ 491 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-m55r79wchx/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 9848da60b74c19523583a237900008a3fcb268a9a4000c352f944f7d9f0d78e3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366578/
  
URLhaus
https://urlhaus.abuse.ch/url/366577/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/5711/

Comments