MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca1db184290b274c1f78b091bf019926fa258dd8b1f5bb316a55832aec970338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca1db184290b274c1f78b091bf019926fa258dd8b1f5bb316a55832aec970338
SHA3-384 hash: fe7a1bc6855ffa9066d206c8e38ae5aef2fab625ea1c2ee6ac2615adbc739da141120a3ab5e28cee91de2cbf6c704ef4
SHA1 hash: ba892d5a61b8520f10eb68cff2ff46a64300edbb
MD5 hash: 01877b0a8b60004f4d47d42a07f9fbfb
humanhash: papa-five-fillet-summer
File name:ca1db184290b274c1f78b091bf019926fa258dd8b1f5bb316a55832aec970338
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-06-03 08:23:01 UTC
Last seen:2020-06-03 09:25:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ab99eed8eac3918122029beac9d5c9fc (1 x GuLoader)
ssdeep 1536:U/tUYSPfxV40/Z8aAYM2YzkgrKHxLdGKc+o0FDHdZ1gILs5f2q6TQHgOsWOpz:m4PX/Z8aAYM1KVdhjFD9zPKRwO+z
Threatray 1'759 similar samples on MalwareBazaar
TLSH 63B36B07ED4E8653D14487BC2D279EBA3A0DA91D49001BDF71399E9FAE326422CA711F
Reporter raashidbhatt
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6232/
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 06:21:32 UTC
AV detection:
27 of 47 (57.45%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zio3dbbjbmtuyh3ywci36amze35cldoywh23wmlkkwbsv3exam4a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
guloader
Create hunting rule
Similar samples:
1df9aa28e1f0652e0797e7531c2965387107ecb56b2988f260d758a932ce3d1b
GuLoader
487032be06deec0a6b50c6c0464edb67d50f9bb769ea1527969d4b67b83e8733
GuLoader
644aa25d23ed0bde16287cbf053890168f01b13ba8909a1c9b984f8f2f58180f
GuLoader
71d8902ce64db45af7c463dcf085067198b934c43169e3eff51e58495a0f65bb
GuLoader
91adaeeb7ac7733741a68cc0283a10f64403f64d1378558bae2342bec847f8e5
GuLoader
9ad345199fba200ac03609aa9a93be1c10663b7c2c1f3d0467e747f0f0147caf
GuLoader
a32c37dd601a6fcdd6e622b2c928c7ef7935a77a0df9a2dfb9c7774630dd266e
GuLoader
a7d93e9c9bb80f0f8a271ae4a101f305bac535e197697b35f291794fa83ef538
GuLoader
b05eb1ace6dd219a6e5ea23d25ea88bbd672ad379ac4dcaa935acbfdece37c0b
GuLoader
e138622ca793f4a546496b40dcf406a83aa667d16fa2a29879d8282a39d6e7ff
GuLoader
+ 1'749 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-asqr7h21sj/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/6232/

Comments