MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d144278763b938fcfdd840307f1e69f58461919b72c5c87a1c9738e76285f423. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d144278763b938fcfdd840307f1e69f58461919b72c5c87a1c9738e76285f423
SHA3-384 hash: 920f65581decaaf455752babdcb2f3b512cf496b0091622afc9ed088b2d3f892f3b2aaa7210fd9efc8832bcc617ba4f0
SHA1 hash: 172ec616a974d5fb6375e9c82659a44ffe71553d
MD5 hash: cfa8b75ab3dfbfe3a39af712b86c2a8f
humanhash: comet-oscar-vegan-indigo
File name:TNT Original Invoice.scr
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-22 05:17:47 UTC
Last seen:2020-05-22 05:41:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 692034f50b260c2b69cec92d67250a1e (1 x GuLoader)
ssdeep 768:3fmyyUaRuhFHR/i2fLEZcW/r8iM6q2OMM+8Dz3N8BrU3gNi90H:3uxaFHxiq4ZccrxM7hMlXjE9c
Threatray 273 similar samples on MalwareBazaar
TLSH 6F933B15F4A4CD61C9504EF38E65EAE016AFFC715F264A0FB088376CAD72A51AE2037D
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.49201.24592.24271.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 05:35:56 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
314c3caa4b1a6ccb17a7348cdf0ac7577a6ccc595a4d6cc0f9abcde2befc58d0
GuLoader
3f88c57eb7f5eb4e623183ce4b3d06ad3987000282cb09b184a9854fd592c766
GuLoader
5ecd51e9131fb350b5fe5b90e4e4ebd71a28a55ca867399f231995e25097da58
GuLoader
84581968dd8c3480b3f0dcc2cd0cffa26542bb8cb79c8150f2be5ea5afd1b6b1
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
b833d79953fe177a48a5832ce2606c41d00f0d5b9bd31ceb25d3055a3850c2f7
GuLoader
d5132d40838a12d557fdcea3492cbe6775330dc7298bb806b076011816fe1f36
GuLoader
d83429370b6d814b6ff67dd1736424db4e11e39ee745867f09c98f49fae4e1fc
GuLoader
e65a5fdf0fa896a90f1b817b341b982cc0ba0ade72ca3542234da82fddcc3143
GuLoader
e9e9a0314ec1302997e3382807436f43a70e0dc2c165aafa6b5b8f3856d04d0d
GuLoader
+ 263 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-2vv562zba2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

ace 2fb5db45c746ad9462231b0c5a73156833c77a8c2241445daf224b8caac2da4a

GuLoader

Executable exe d144278763b938fcfdd840307f1e69f58461919b72c5c87a1c9738e76285f423

(this sample)

  
Dropped by
MD5 d27e01280e330f5cf8b012828adc64be
  
Dropped by
SHA256 2fb5db45c746ad9462231b0c5a73156833c77a8c2241445daf224b8caac2da4a
  
Delivery method
Distributed via e-mail attachment

Comments