MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb2faadcbc0d7c66a84bb763e34cc811194f21a2222541a62fd1c0d9d3ce6c42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb2faadcbc0d7c66a84bb763e34cc811194f21a2222541a62fd1c0d9d3ce6c42
SHA3-384 hash: 212cd8a23b0d9a0dd621f953a14eeae1aa0430dfcc3897731f25154f155c80b3f936e5b59d15a2701b1c2006e5ef5444
SHA1 hash: 21f2bd7a30f59f7b87779fbbafeb116fe139c9c8
MD5 hash: afcdd5d68994ad6e9c6b5925a7afc176
humanhash: floor-failed-double-steak
File name:bb2faadcbc0d7c66a84bb763e34cc811194f21a2222541a62fd1c0d9d3ce6c42
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-06-03 09:22:21 UTC
Last seen:2020-06-05 17:36:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0cacd2d748057964770667d197567409 (1 x GuLoader)
ssdeep 1536:h1SPfxV40hoUZ02kgrKHxLdGKc+o0FDHdZ1gI6QDEJzhM4hNf:mPXhtjKVdhjFD9zA1hN
Threatray 952 similar samples on MalwareBazaar
TLSH 13B37C17EC4D8A43D2444BBD3D179E793A0DB90D4D405BEF74396EABAE326022CA711E
Reporter raashidbhatt
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
6
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Lokibot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6238/
Detection(s):
Sanesecurity.Rogue.0hr.20200604-0805.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 02:48:05 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmx2vxf4bv6gnkclw5r6gtgicemu6inceisudjrp2hantu6onrba._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0afe73609922b94ffb25f673db3b621befab30c7f52cd586497b63f8154dbd6d
GuLoader
2b7498abb82bfc105fb641bc1b9e9da602bfeefb252dd8d16d7c1e4fbc3a4668
GuLoader
2ea5a4fb25528051254f255dc64913ca7d4faa1ecba2f40a55b536f871624fb9
GuLoader
504cd8dcf16b6e6b55271ef9bcd8603916ec5f81fdeb0615e3c970954d50a7f0
GuLoader
67aa5b86db90b286266d57324824825453a9db72b15414ee064dbf01085d00b4
GuLoader
818a7b0f2761340c423a9feabe5aae7fbf96129316ae4b0a11357cbaed344bbf
GuLoader
a3c9b063a2e0b2543b34146f01d970f5ea721fac3fccc95bf1afdac5a56164e9
GuLoader
ad8a37712f8cacb5def3dc81a53358ad76ef3800ef3e4fc3d151f17e594d93e8
GuLoader
c882cc422e4039600b31e53e369f05b29dc9dd38cab76facef8a42adc8d326b3
GuLoader
e0c1fb97e28bc9944bc045ee772dd8da34a985a9e410764734eacdb35429cd1b
GuLoader
+ 942 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-x4ncajabhs/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/6238/

Comments