MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8860da111fd60fd6bcb2d6ffd3f1a62357d1da8888b766726bcf0919ba25e3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8860da111fd60fd6bcb2d6ffd3f1a62357d1da8888b766726bcf0919ba25e3e
SHA3-384 hash: f0acd4f9c6cd503bf2fecf282cf67dc0cf6d2262b490be8da0db811d7f3b430151a58ad5c3d6a7bc64de683df5a60cbb
SHA1 hash: 2c38ee4d10901cc1d648ef11dc82f40158682fba
MD5 hash: dee5071c3635f7141349d5e489899d47
humanhash: twenty-hamper-violet-ohio
File name:SecuriteInfo.com.Trojan.Siggen9.38786.25279.5423
Download: download sample
Signature GuLoader
Create hunting rule
File size:122'880 bytes
First seen:2020-04-20 14:51:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 37013b70f0445e4e8bcd8dbde69f1872 (1 x GuLoader)
ssdeep 1536:4N4HOxXnHHc/Bl1VjIMQDdhdKZn3hg1O3FNsbNrb:4NnxXOn1VjMgXr3Febx
Threatray 75 similar samples on MalwareBazaar
TLSH 94C32A507594FD82C9164EB14F74CAAC15AAFD34CD48294B30C03E6F2BB26D27672B6B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-7678975-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-15 06:22:44 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xcda3iir7vqp226lfvx72py2mi2x2hnircfxmzzgxtyjdg5cly7a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
082433d5a03c1b8d3afcddfd4dade5d0d14366ad0d1e8d04c2f70fb40558b9cf
GuLoader
28a945b0afb49fe99da8a39746a00b93c1a2c0d5b8735e11d8617bd696b2f199
GuLoader
2b911df18337cc69e42d8c16ab58856af2722c7618146a491c9efe54aa73fdbe
GuLoader
4e9725c1d27ec7cf15d2b159b703764c59ee647a76060e937fbfca3a73ecf889
GuLoader
6ed38f127b3a25cff62c0855aeba85a7134a400b1dd4ef06412c2a96729b9991
GuLoader
76021aea3ce29a8755d97b4c13d16a7bcb9eb0bd6e1a2d1df62ffeb8fb9397cd
GuLoader
92be89b620f61dba7a3c69c6e597787a02b9b8f7e0de333c589ce5048cbd8e6e
GuLoader
a7ed52eaed3c431823109509515c36b6bf45aab634606980509950674f018f88
GuLoader
e91568f40d148d2bdf04cf14156febbbb0d72e10b876c38d0900e0a66cb8706f
GuLoader
febbc268d54ae4612531ceb696c39bd8c0a60ea22d2877751eecce32bd651257
GuLoader
+ 65 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe b8860da111fd60fd6bcb2d6ffd3f1a62357d1da8888b766726bcf0919ba25e3e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/346735/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaLateMemCallLd

Comments