MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1e8840b05e211a9aa314ac0d4359068094bd9016c77b43591bc543b37e7022d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1e8840b05e211a9aa314ac0d4359068094bd9016c77b43591bc543b37e7022d
SHA3-384 hash: 74a1f28e6616d1729dd67f3ee8a8537b9eefb5f686cadf85e9cd2e4b4827f6e152b2287103045c23b3a738b9aebcd1b5
SHA1 hash: 2c3116d7882ec06ca91179ed880ff6be66ac98b0
MD5 hash: 4efbde8f26b3a99588c9fe291ce3c06a
humanhash: network-arizona-ack-rugby
File name:Pricelist _ EURO currency 2020-2021.scr.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:192'512 bytes
First seen:2020-05-28 13:28:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ccf1b267bf19ba9fc9c74838be1b0098 (1 x GuLoader)
ssdeep 1536:rVuYWjkzONpxaxcCPKdhQCBUNji0dWIeZgdUWgGUtLEPEnjKR6DMjTJ:kDJNLa2Cob0dWMzgGRJ
Threatray 209 similar samples on MalwareBazaar
TLSH 5C144C22FAB7DCA2DA450574CAD2C9F50460EC10DE068E2B72C07F2DB675187AE76736
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/5871/
Detection(s):
Win.Packed.NetWire-7916261-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:28:24 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
09838078bc786269db65986e324234d647ff0154b07565e59bdf34f5f72d650d
GuLoader
1f93e9ec506b2df6670b01905f5c42e05d7c2b4dbf44e37d82ee8050528d961d
GuLoader
2514cc0d95a79227b308e5834eb780ba105109fcc7fc02fc11ef3a03e61cac46
GuLoader
42895dc552049d3cfd80ced83d8e2fbfc30adc3799e3748aa5f9e7df32373a58
GuLoader
4408001ae2b6c11aa2c25f77fea7d8c2118d7eac3f8409246be40b7549b408d0
GuLoader
8b04dcca28022f6065a0aab229d6fb466ae313dc5dda21b0a7222225d0facfd5
GuLoader
a58514d885d493ebb627f107f0a3ded181311e153038fdc1626323bbea512f47
GuLoader
c2fdcd6737639defbb98a8cb6d0799f59644599d77b0d8bb231a64dfba2a26db
GuLoader
c3242f5a544110304212594891c9f8bb0c2e61f29d904271a09f5b0f94437348
GuLoader
fcaa4b93dbdb7ca43dab06e0afb63117ca21a864f7ccf6f6eb7a4581ded48464
GuLoader
+ 199 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-gzxqgdyeen/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/5871/

Comments