MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8b706bb1149005a7e27ee5f954ef9fc057d3d92197079dd3436c507dca3947b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8b706bb1149005a7e27ee5f954ef9fc057d3d92197079dd3436c507dca3947b
SHA3-384 hash: f7286180b63f7a589b710b295a9187cdb96c9e21ba81beeb3fe20320ad8b20f0d411f36ffc5b951110bc54d99e677597
SHA1 hash: 5f76d1907f984ed4592a8e816bcaa1c75efb360e
MD5 hash: fa49444f251fda53b81f010cd1228796
humanhash: saturn-early-bravo-friend
File name:SecuriteInfo.com.Variant.Razy.667447.3436.13105
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-07 16:04:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c7f99b1818a68e360b370519c7a3624 (1 x GuLoader)
ssdeep 768:/Nxq/sdj22G3/TKN0UWGpl7sv6C/g04t6BsBO2m:Tzdj22G3rKN0UWwl4vvG5m
Threatray 205 similar samples on MalwareBazaar
TLSH E593C2226EB5ED26D25476F1EB59F39FC311AD3625314C0B24897A1A2F32E02DD3129F
Reporter SecuriteInfoCom
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.667447.3436.13105.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 11:26:57 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10e06d6dedcfa52bb09cfb066ed4b5276a6a60ccfc5a6230911ce04b829f381f
GuLoader
47296594a8ffd81843b838555873c6c129bfccd6c211c4033de7cf7523190bd0
GuLoader
623d2dced40110b216c19c5d48ecb250235278055ca3a7192ac98a8640d663f2
GuLoader
739d40c80783a52ae341907b2996cac8a4a51189c176d9e3270a74c3e9d7779b
GuLoader
8d5a770975e52ce1048534372207336f6cc657b43887daa49994e63e8d7f6ce1
GuLoader
b32598815ea88a25f6459ae8b5035d0ed9c787d8fee5f124a24543c0550d9070
GuLoader
b4cb5e02fc90c85a8ec05d9216df64e392f416f6d6fc41366608920c9cbf2466
GuLoader
c12ceb5bc795285eff54b3ef08c9208c67148b5c446e21084677c25bf8c56112
GuLoader
e80e2cf38bd72bd64cafaaaa0eafc2965bdda90feeb5c153947f81dcdb98e6d0
GuLoader
f3b9c07ea611e968e7483b8828a480ff7b356a43eab344c984b37930c8dd6417
GuLoader
+ 195 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-v6m4jf8ava/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe c8b706bb1149005a7e27ee5f954ef9fc057d3d92197079dd3436c507dca3947b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/359403/
  
Delivery method
Distributed via web download

Comments