MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bda7bbc040614aea40e36657bd8f2b28145fa7572e2810455288ad21c95fae14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bda7bbc040614aea40e36657bd8f2b28145fa7572e2810455288ad21c95fae14
SHA3-384 hash: cd0d084fef919a9ff84da7f1b3675354380b1f086e8e126a77aa95537090c1f92e0116ca6c7a28af66cde26a21df298f
SHA1 hash: b779968c3ab961e1d651e5e6459b9cb339187a9d
MD5 hash: 8c2acb53d86b2ff6dac7856a755e1108
humanhash: timing-oklahoma-uranus-lion
File name:SecuriteInfo.com.MSIL.GenKryptik.ELBN.10191
Download: download sample
Signature GuLoader
Create hunting rule
File size:686'592 bytes
First seen:2020-05-24 19:36:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:++pJQ3IEcgX95lGAVpe3PvdITQ252Ej6mT9/kY+G0N6LzeY/Y:++pJQ3HcygmU3P6UsTemT9cYF0NkfY
Threatray 475 similar samples on MalwareBazaar
TLSH E3E4239927709B1FCE3E07FA8550751EC3B079366E42D38D2CCA60D54E5BBA0D920B6B
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ELBN.10191.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 16:11:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
15145ed8e5ae3cf2acf9ad25bbcb3f782c4d8ba9674185d06baa66ae6d17f25a
GuLoader
151f57078e89aa2f81fcb307bf88fe23e9f2437a4df1e37def5d0b78797e12f8
GuLoader
19e99ad36e248449944d9979c433f0277eac9e2b0911259e5c39d33bd194f399
GuLoader
57c4cc3ddd55171f1d7fabb27f67dbecd9ef59a7e752956b4cf3efa946d0d351
GuLoader
6746b12200fed6aeb1764594c84ecd3485e74114325c150ba41d12c555b182eb
GuLoader
7294bdc3333d08ac9c2397b3555c0126928c13600b23de09f21841cfee83f55a
GuLoader
7d02ae5ae3ed3b7a13ff5495174216ea3195764d7154b8e9b4997c74fd08fb09
GuLoader
82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639
GuLoader
862b45e2c98a175f625797db1d3342e0d9dc35b79e3386deb42c06b1918867d9
GuLoader
a03e9689d30d9691f4b2b86dd2c53b072ed290efdac0f6b2230fc445cbe8f26d
GuLoader
+ 465 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-85stcbj66j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe bda7bbc040614aea40e36657bd8f2b28145fa7572e2810455288ad21c95fae14

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367553/
  
Delivery method
Distributed via web download

Comments