MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1d9e9253d722a52cab9606aec1d7d7629b4316b0c89c54406bfd595ca7bfbca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1d9e9253d722a52cab9606aec1d7d7629b4316b0c89c54406bfd595ca7bfbca
SHA3-384 hash: f7cbbf2fbbd7d408def52a61804cf23d67199d1bd415f85a0b6e4ba09b7679d49f0c55277dfa73e26f95cac232f10243
SHA1 hash: be0ef016ad2b6cda3823d89531479e05d4580117
MD5 hash: afc2b96b6b563fec275f9a0d2a1972e2
humanhash: whiskey-march-seventeen-lima
File name:ARBEJDERKLASSE.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:122'880 bytes
First seen:2021-02-05 11:47:51 UTC
Last seen:2021-02-05 14:05:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3002aa90a6228138c61e6ac642f2d8b4 (5 x GuLoader)
ssdeep 1536:aIP7EX7eIBNKUqTyyEJo2P2GmIc9d7KqadbVZ4AuTdVOG1xNw3E8ZgD0:aIYCIBNKpE2GmFRAu5L+p
TLSH 89C3B4A3B6C5FE96D212C071AE0491F81243BD38FB054A03F2C13B6E7A757D159687B6
Reporter Anonymous
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ARBEJDERKLASSE.exe
Verdict:
No threats detected
Analysis date:
2021-02-05 11:45:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4fa49a37-2875-4267-a61c-e9e985755873

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115731/
Detection(s):
SecuriteInfo.com.Variant.Midie.78971.25755.15308.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/600175
Signature
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected GuLoader
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1d9e9253d722a52cab9606aec1d7d7629b4316b0c89c54406bfd595ca7bfbca/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 11:48:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2hm6sjj5oivffsvzmbvoyhl5oyu3imllbse4kragx7kzlst37pfa._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210205-tbxm6s3zme/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
d1d9e9253d722a52cab9606aec1d7d7629b4316b0c89c54406bfd595ca7bfbca
MD5 hash:
afc2b96b6b563fec275f9a0d2a1972e2
SHA1 hash:
be0ef016ad2b6cda3823d89531479e05d4580117
Link:
https://www.unpac.me/results/94affca5-0f73-48a9-ad50-71f80f338fe9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d1d9e9253d722a52cab9606aec1d7d7629b4316b0c89c54406bfd595ca7bfbca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/115731/

Comments