MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c22798f361a044104ff74ee848901f492c204cc185bcd865598677ddd62021b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c22798f361a044104ff74ee848901f492c204cc185bcd865598677ddd62021b2
SHA3-384 hash: 4a8a18ae21bdbf3a4d63ad88752d400d6a6cb9d10f187fffcd0497af2b6a3cb2f43e2c8ce29cf5b382d49eca557a701f
SHA1 hash: fecbf511019022a67aa912cb237581a9be740926
MD5 hash: 7bb15dd577fe1a252133aa49ca242458
humanhash: bulldog-mockingbird-angel-bacon
File name:Bank transfer credited to your IBAN.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-12 05:08:58 UTC
Last seen:2020-05-12 09:05:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3c58d4918f6b897256f3da75e91f6410 (1 x GuLoader)
ssdeep 768:402XnFAF3TSIOYIfj7sG6M64XbvEdH1Z9Omxm29Q4ZsI7Dkl:4znF03GRYk6+TEDOSQ45Y
Threatray 289 similar samples on MalwareBazaar
TLSH DF934A1375D4D423F6198AB91F2ABB98061AFC710A558D073AC53F7E1F72B22B52131B
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.45748.22696.11293.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 02:50:56 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yitzr43bubcbat7xj3uerea7jewcatgbqw6nqzkzqz353vraegza._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
01f0b05574fcb3c10aa17fcbc2543497c2b7a6747e06e34e5e30070a2ce51bdb
GuLoader
2679b68e7d2bc1eff0bb4969fc23081d38f08b72510107adcb18a2ffaa9ffca8
GuLoader
2cd6fffb63a9a7e9c8b6709904d69954c4818e64dcf7e3bd95eea2a7ae28cd81
GuLoader
30ffce543f13fce23c61f63f8a6783b1c3be723377cb13e13bf033cbff8b904b
GuLoader
35de9956cb66110ef820db84e9eb9af8ea161f63a7ccfceb482c21299db67e9d
GuLoader
6feca5fff7a7a08ed572eed6241b0d07bc7b4cebe114e076be426badfc9e439b
GuLoader
720004239ef0cb716b2f0d8793cfe7fb06d408cd5c598a6c726aab7f21c0bad0
GuLoader
87fdcca436e0e9e220acb51332720668c04460d48d1791368e734c1539bd1f77
GuLoader
9802e8e7e84d1f454d72be9f937a7ad59230de4819f94535c7219bc347c587e2
GuLoader
e44cb40eff38efdf851b40d465ffd44552597c19efa887c90e524fd2b3bca086
GuLoader
+ 279 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-4lcv7chznn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 4f1ec999c1d0d7fa9cb12aaceb0d3efb58d846b315fad36c50c9bdb19804dc0a

GuLoader

Executable exe c22798f361a044104ff74ee848901f492c204cc185bcd865598677ddd62021b2

(this sample)

  
Dropped by
MD5 62dee7e4f577a735041eeed07df65a3e
  
Dropped by
SHA256 4f1ec999c1d0d7fa9cb12aaceb0d3efb58d846b315fad36c50c9bdb19804dc0a
  
Delivery method
Distributed via e-mail attachment

Comments