MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1817ff59a466c2c67ff443922da2ea3e4c67b8ed1a5e67c44a0fc4faa8956b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1817ff59a466c2c67ff443922da2ea3e4c67b8ed1a5e67c44a0fc4faa8956b9
SHA3-384 hash: 31a2a2d0451eb657ccf9bad329afa59699133d6c2cedf0de82a10cc7d223acac994e205f99df71e53f454a2a397c4a9b
SHA1 hash: 9aa717a6f8086fc1a644a0d78955ee7fff2f5ef1
MD5 hash: 7c4cd4de7e4dcfa4f21fd62f30481125
humanhash: early-mockingbird-echo-nine
File name:K2ZSB.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:167'936 bytes
First seen:2020-05-18 16:58:02 UTC
Last seen:2020-05-18 17:54:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d64564e786f984370729c3d79d7464ad (1 x GuLoader)
ssdeep 1536:pCMkC+ihbZ+wIYymgl4TsR+fNYSUMmftM4E39AuI+oOL0nsKPUd9nQ:8M3Hhblyr5RQNmTM4mGuIw3K
Threatray 215 similar samples on MalwareBazaar
TLSH 5AF34922F295EA06E5314ABE8BA6C2F554262C718A41C90775C53F1F3AF2817E7B1337
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 16:57:50 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
2abe71b49e45492b408294a415a308799ed312ff79c013924a42e53ce9c32a82
GuLoader
443bc33e9d28fddd4229367cde23085b8d57549093ce8e991eb4753ce58c85fe
GuLoader
75da456980b6c16a80a05269d6fee93bc18a242ebe0c7f9f014bad8828b09291
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
d7f4b62e461376eae0f1665b68d315866b292b7ad2818c48fafb5c3102b76dc0
GuLoader
dda25996ab5b78fa63ab71aa304360374fe2eb6ded670c778b2c69d9fa1f1e40
GuLoader
ef8f03a25087eeab581d8439a0a19ba7148270d2210d479c1d6867fac69dc813
GuLoader
f3d5f3e56bf902a666f50102934c54c047caa046484b05c638d7718f35ce3d9f
GuLoader
+ 205 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-dkjpbdmsdn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments