MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4f463437e9cc07319a75e55ebd84f4af81821747911be7c6a49ee1395541bfb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4f463437e9cc07319a75e55ebd84f4af81821747911be7c6a49ee1395541bfb
SHA3-384 hash: 21b978d571b8ef85a6ec8ee5a52859734704a55b19c0842e2559e8b645ad4f071eca88af374ee37c4f98ff2416acd27e
SHA1 hash: 7294b9eee7b16b2989df72c66553e0789dc9353e
MD5 hash: eee2828e893570ea94ac7e8b8fccf548
humanhash: delaware-march-carbon-zulu
File name:SecuriteInfo.com.Fareit-FTAEEE2828E8935.13606
Download: download sample
Signature GuLoader
Create hunting rule
File size:106'496 bytes
First seen:2020-05-07 16:04:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5a2c989b9753fd8dd9ce235c4e51c3c7 (1 x GuLoader)
ssdeep 1536:KXbc8v677wKFI4lae9MLSSMKyDK98GcvX:KXbcs627MKyD8W
Threatray 192 similar samples on MalwareBazaar
TLSH DDA3D9186AE1EC17D5ABBAB1D781F6DEC3885C322431560775C0724B4F71882AFA1B7E
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

SecuriteInfo.com.Fareit-FTAEEE2828E8935.13606.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 11:22:29 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0098bf2ef8230d9bb30b451868272ffb271fe63a8c248bfc9ce569991c19f279
GuLoader
1ffe8a0c22c433b676f40639e236a1c7cc58656be5150f1bd4dc7f24d807c761
GuLoader
6cf91b93dd7a3a6aca9878a5cf252af90000628486161243a086d6477d5d1f04
GuLoader
7029a84f194657063ae7b30c973fef675bcfd1065100480441ae69a597de2e10
GuLoader
ad902bad9f459a31e657fe826869a611507af41776e323f285809a58e5f1172b
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
cbba3a76832ca533bccd400adcceb5e7f9f06098f2bd2c476951964edd552d5c
GuLoader
ccf8d12701f350ccb107f9a25763fa892c879109edf54a0d3811f4562dcff85f
GuLoader
cfbd66845ba87ca332833515563aaf417025692ad4f341567b7bd11a509c06d9
GuLoader
d706cbce022e0dc6fe2aaf90f976383d10132c6ed8f5fc27b65e1364fdadf0f9
GuLoader
+ 182 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-fat3ek4z2e/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe b4f463437e9cc07319a75e55ebd84f4af81821747911be7c6a49ee1395541bfb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/359354/
  
Delivery method
Distributed via web download

Comments