MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8709a0d94df64f37f997373ca3686aa4071ce1da9a407bcfee2fdb0ce9d096c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8709a0d94df64f37f997373ca3686aa4071ce1da9a407bcfee2fdb0ce9d096c
SHA3-384 hash: d9bbfeab4a238840bf40e682d2eb36be456cc3cab300f61adb81a7b333125f2db4b1db7922989a51bfcde52ac5ee33e8
SHA1 hash: 2b4d9ff2af341ab4a25a0245d51688ae3eb6a98f
MD5 hash: 8e33e77484163c45fc23f8f36077f049
humanhash: march-early-glucose-island
File name:P.I Format.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 13:25:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a4affaa45d87711c7249adc264dd254b (1 x GuLoader)
ssdeep 768:byCwGMjJvbviBad/teBUW9RF8SLTbL1CCa+xX/e0sGOj3qyfZLf6m17NT60r:byfG0J6XKSHPNOrqyfZVN
Threatray 827 similar samples on MalwareBazaar
TLSH 3E534B1BAE4CD953E06087B0297295B526156C285506BF4B7EDCBF2DEF321827CD331A
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/7562/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33999990.9942.22616.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 03:17:43 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xbyjudmu35spg74zonz4unugvjahdtq5vgsapph64l63btu5bfwa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
2c80f61e5c61bb87be9e2d60e69093bcb5082fc690fcd751be787dbd118d5e57
GuLoader
2cb2d3d6e9eae7df795b4c26fe1e27906e12b0d3d9bbec8c6829abadfb8694af
GuLoader
54d3e50350cb0e6e43cae0d762829aeab02a389142d24d5c8d71c413e1d77842
GuLoader
6715e87f7070a2d7b5b2c71e98a7bade689a504aed3b95654af3494248a501d4
GuLoader
6b44f8bb0a99d2b29794f048d92bd25805461a6eb9fe45fd82836deb63adb774
GuLoader
7a7760c4a4b1244950ea0fd475c53005ced18cb314a2e0fc4499086582e1a5aa
GuLoader
994655b2cfd0979f7b96ae1f4423510633a82adf92fa6486dfd2f3243e96618d
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
bd8b83f7dd16986237807033ff8ce00cda8d173d44a9e9f95e7a8e77877825b1
GuLoader
e28da88ff0d294d8f4bc7cacae31814a43026ddac38a554ef697e703122e46c5
GuLoader
+ 817 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ksvg4sf83e/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/7562/

Comments