MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aee6f41ba3393811f2980cec1714785039dd6cfcc629b81479fc376f635868c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aee6f41ba3393811f2980cec1714785039dd6cfcc629b81479fc376f635868c7
SHA3-384 hash: 08480e4cb807bc49e8adb07811e48deb81bd10a0041cab58d4c162d49bc875458451c3e4c1f4a6dfbb1dc10e9c27e596
SHA1 hash: daf561981c38dba10440e48660bc55c3d57690dc
MD5 hash: 928ac4fab89fcbe9d9b37a65b549a9d2
humanhash: berlin-october-earth-floor
File name:RE Proforma Invoice.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:192'512 bytes
First seen:2020-05-19 04:47:48 UTC
Last seen:2020-05-19 05:45:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 16daae6020c6875d057ac6f273033fa2 (1 x GuLoader)
ssdeep 1536:uPjOV8I1obdncfAyshYt6ZYLgWdzFPO0gMrJteE/1+3uUnpgyQFLRMCvN4OekMfE:WNg4jb4kqKMZjosBhjDeu90Frof0yB
Threatray 866 similar samples on MalwareBazaar
TLSH 33143A04FA90F82BDEF98AFE46E659B590CA6CB66905D303B5407F3F32F14C5A124232
Reporter cocaman
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47136.29281.29004.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 05:36:04 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v3tpig5dhe4bd4uybtwbofdyka4523h4yyu3qfdz7q3w6y2ynddq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
04fb4d7876dc1e4c31448a62dbc77223b453fb6abd187c92f51658807c21eaa5
GuLoader
0d803d4ab4cc06e12ba51d6af2a2c5d4b6a2d0c38bd766972e2d7b96a10372e2
GuLoader
1f3155a17517ae07b481c78d6611f7053275b9d488d7475aec599683a80d8a85
GuLoader
396c67d17bdba56c29d4774991879313c236e9db5b9e1173f322d1bd3194edd1
GuLoader
45e16f925fd769f19452d415ba3ad69fa6bc5c3e97fef7f048d13f2fabe840c6
GuLoader
57aa81416cfdbd76df2a15cb14810f8529ecab0eea978210a4ef3047f35a225e
GuLoader
5dea44a2d2fc0b39ac006a205011b1fe30ef15ad69536f263ced6423a8280a1d
GuLoader
60c2a6a0bc12f4b6fd4ecb473d5de3d9de561ee3125055dbbf2d8ff12bb83f60
GuLoader
950c5135a82ae668688c83c699fc372e74f2745aae8effd9f87fcae2b4a447be
GuLoader
b9eb219ce57af2c2320bab070cc02c9c1e263b6cf79205a0799129bf29d22a5f
GuLoader
+ 856 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-rxp2p74yd2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip a8e4b2993ebac406c7945e801e7da09e94393b8ee4a52114e4b40255a8c2a737

GuLoader

Executable exe aee6f41ba3393811f2980cec1714785039dd6cfcc629b81479fc376f635868c7

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 a8e4b2993ebac406c7945e801e7da09e94393b8ee4a52114e4b40255a8c2a737

Comments