MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0980c0b0e0c3e32a5910fc48c6a03d5e99338900f7b41d4d7ffd0c70b7354ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0980c0b0e0c3e32a5910fc48c6a03d5e99338900f7b41d4d7ffd0c70b7354ae
SHA3-384 hash: db205641de6677b61db06f0f2dfd99bdcb9c5bbd8a9ee1aa1b19c45720f7fb3ab54063a8c73732da5504281fa7eea827
SHA1 hash: de2d747c0a0bc91d7ae2849aa66161edca4a875b
MD5 hash: 0758eeb149d350fe9e4605f2a6cd69b2
humanhash: delaware-south-diet-rugby
File name:Order83928.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:98'304 bytes
First seen:2020-05-21 06:53:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 45921ffedb2a1791c75bd26b7156ae29 (1 x GuLoader)
ssdeep 768:mMrMMlvJ0uCrPptEGcs8rj00W5ctaXXYgyh9bks2rzr8ZseJdyyUIy3SME80sGSx:/oPT9TmaXXYM9eJdvhMMr1WUVby
Threatray 195 similar samples on MalwareBazaar
TLSH 87A32931F951DC71C86845BD6E628A28622FFE700502CA07B4D67F1D3AF65CBA43A74B
Reporter JoulK
Tags:exe FormBook GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Fareitvb-7861078-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 07:35:59 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ucmaycyobq7dfjmrb7ciy2qd2xuzgoeqb55udvgx77imoc3tksxa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0fe7ea8749ad06ace6adf0d7ffa5f6f22ade0f9acafc4aac72b77f3b7c017ad9
GuLoader
2c1642f94762a15404bbc286403d839f6ceba0659179aa227232af98d2b49d6d
GuLoader
7556ace3bd8a035ca289145f068029f6137fe41f935b32fd1d0b046d1f2e05ab
GuLoader
814e2c04eb5851c9624cf3b0871932e22f99f0b3cbb9b22d987829cb05779e37
GuLoader
a9266bf550d2639f64352c62d4a4f59ac24cadabb6bb459c448935feb2303816
GuLoader
c3b88b1d9c86a4f7cb1ae7c8b91d44d67c9c9e66ea51504c3204eb575a668fea
GuLoader
c52ca2d3f581c0f1149d3538a985bb896755356d0c00abc546c142accaf0015d
GuLoader
d145458cdc385c244881e7cc9e5a2ec27966eb5de70c601f79449ecddfd90fd0
GuLoader
f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d
GuLoader
fe0e6e3be607ade9869e9d5a06c87f2485aaf35a29691f74354d7e6a386e711a
GuLoader
+ 185 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-4343wdyd1s/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments