MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8e91120db97c2cc33d799fb33cefcb6e199cb68c824500f22ec8fc1736a90b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8e91120db97c2cc33d799fb33cefcb6e199cb68c824500f22ec8fc1736a90b4
SHA3-384 hash: 630ff1ce7e026c2638965b777129de6f8b54cad30a9ee7cd4dfb6f513f1f342dcf48094687c97195573a437dec006346
SHA1 hash: ef087ef03536f4e84d6820b38f989745515c9227
MD5 hash: 42d7484c22754ce8f9bc6c5f506f8bf1
humanhash: gee-delaware-item-rugby
File name:42d7484c22754ce8f9bc6c5f506f8bf1.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:61'440 bytes
First seen:2020-05-31 07:49:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c410165b092e53043c099ba331d82c35 (1 x GuLoader)
ssdeep 768:7XuGl4VRZ0gfH+Yqn+aPcIVJE1RpbkiK55MegINirj00X:7+JVj0g+YIRLVJiRpfoNon
Threatray 991 similar samples on MalwareBazaar
TLSH C5536C67BD489422E21147B11591E7B1BB36BD266902AF4B718CAE2EDC315C37CF231D
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1cjlCID3JszDMe9c-yjWgCmhCwqTfBzFp
http://ffvgdsv.ug/a_uXEGSDNimE3.bin
http://ffacscs.ug/a_uXEGSDNimE3.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5492/
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaCO.34122.dm0@aSucLiP.22577.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2020-05-31 02:14:25 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1403d5f33c1379c32f1cb03b1c72d317b81541532647386e7aef8ba51f4c18c6
GuLoader
17f52dbf63e20cb471e6da579551830186446d814a14162ec3569c62fb6f0771
GuLoader
45a77c8db2a1fbc694fc6ab1177a1b4b83d0d5ff5d1027532fae405aa7e72e7e
GuLoader
6535df8dcbd659939c18a93ee2b58e8ef05898e1baa30932cf3cfa876659d183
GuLoader
bb19d9c9c18233bf65768ed3534766ae87ada589f6223d015c47d5e4c2523d64
GuLoader
c8bdfc9eea22464897b3dae7829464348f27a1ff1989cf33d1de95bc0a99527f
GuLoader
d725785ec3970b75ecb17a7e5ac14d93ce7a54d259dffc74e8222ed8cfb8b6b3
GuLoader
e265bbf3f727ff892423b3e24b5368ab4f694c86334bf68ae62ff20dfd7ce5b6
GuLoader
f0904d56b0d621156adf1d4449d1b445e6d45eec9c0a4b09e22f9bb95a185955
GuLoader
ffa86315bf2626a0d898bfb87783206ab4cb64b9b4c645661c644f717052ddf9
GuLoader
+ 981 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-61pe5a6p22/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe c8e91120db97c2cc33d799fb33cefcb6e199cb68c824500f22ec8fc1736a90b4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/371162/
  
URLhaus
https://urlhaus.abuse.ch/url/372647/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/5492/

Comments