MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b32598815ea88a25f6459ae8b5035d0ed9c787d8fee5f124a24543c0550d9070. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b32598815ea88a25f6459ae8b5035d0ed9c787d8fee5f124a24543c0550d9070
SHA3-384 hash: 6372ccfea7d82e1eb353ce29de4bc763279337e2dbd4927a72f57bcff34c9df4cfe5750dc32552982e4cb90c9e94c734
SHA1 hash: 68d022bfd92d1754d1622d8f45312a02943baccb
MD5 hash: dfda7dfdd659d5e2ef872f8faa5bfa8c
humanhash: summer-ceiling-mobile-tennis
File name:Swift -11044TRF120200705.scr
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-07 05:50:47 UTC
Last seen:2020-05-07 06:51:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b2f499858997daeccfca4cba2371bcf4 (1 x GuLoader)
ssdeep 768:AwwhkxWoaGy1vfWMmHVbyxsOCMM+aTZXK6Yd880H6irocIVfe106MXX:74wny1mRbyx3M+aTZXKB8XH7sfjn
Threatray 72 similar samples on MalwareBazaar
TLSH 5893D429BEB0ED66C11479B0EB65F2AEC755AC3025324D1B64C47B5E2F32E228D3125F
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.667447.26196.15498.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 06:26:48 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmszrak6vcfcl5sftlulka25b3m4pb6y73s7cjfcivb4avinsbya._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10e06d6dedcfa52bb09cfb066ed4b5276a6a60ccfc5a6230911ce04b829f381f
GuLoader
39067a6a8ac06d60189b34afbb9acd73e8e33aba91653c39a037c2f78f972f29
GuLoader
47296594a8ffd81843b838555873c6c129bfccd6c211c4033de7cf7523190bd0
GuLoader
623d2dced40110b216c19c5d48ecb250235278055ca3a7192ac98a8640d663f2
GuLoader
7c58672f646a85dd65ae2c5d44fdcfb899584a9a27650418a06ecc495cdf7a86
GuLoader
b4cb5e02fc90c85a8ec05d9216df64e392f416f6d6fc41366608920c9cbf2466
GuLoader
c8b706bb1149005a7e27ee5f954ef9fc057d3d92197079dd3436c507dca3947b
GuLoader
e80e2cf38bd72bd64cafaaaa0eafc2965bdda90feeb5c153947f81dcdb98e6d0
GuLoader
ec4171872384e62627b06976f6e513650087c00e8c42f70d6b9d29b54e18a8e6
GuLoader
f3b9c07ea611e968e7483b8828a480ff7b356a43eab344c984b37930c8dd6417
GuLoader
+ 62 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-wez98jbche/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe b32598815ea88a25f6459ae8b5035d0ed9c787d8fee5f124a24543c0550d9070

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments