MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d29fa6e0fa83a4332afc39315b3961e609bddc91c1b60590c82b009d20cd9f3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d29fa6e0fa83a4332afc39315b3961e609bddc91c1b60590c82b009d20cd9f3a
SHA3-384 hash: 8f6cff84f6d8880a6e077de817bb1247f8a89357c40fdebb36bbb5c76ceb61b274d0f57ce540c76c9ba1a03cd88f2681
SHA1 hash: 84aae55bf56d3da3c10036107eb05b9f6b29be4a
MD5 hash: e7e7bd8c2893686b1d3c5117660bc669
humanhash: uncle-eight-bulldog-early
File name:e7e7bd8c2893686b1d3c5117660bc669.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:61'440 bytes
First seen:2020-05-31 22:28:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b810b2b69eff043875c4ed23c7ba75c2 (1 x GuLoader)
ssdeep 768:uXuI42jcsTUp7yN1E4dfaeS5tKQBWXJAc4cnQKM1Fj3JpprcQk990QnQft:u+z+cXp7WO4RCUXJL4cnylpRcpjQ
Threatray 941 similar samples on MalwareBazaar
TLSH 16535B2B7D4C8022E210867116D4E5F27B75BD535902AF5B74886F2AEC325C77CEA32E
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=11NAZslAWBWkK1b4dFviELvvgWl48QHr6

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5496/
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-31 19:48:31 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2kp2nyh2qosdgkx4heyvwolb4ye33xeryg3alegifmaj2ignt45a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
093e7cd7215e4c58cde245f8febd7ae91c79e3d01786e8166b6627536415dad2
GuLoader
619bf3fd6586a7cc84f1c3bb1a8a9813513895c10622e74d1f1bd2a37f2fb041
GuLoader
6535df8dcbd659939c18a93ee2b58e8ef05898e1baa30932cf3cfa876659d183
GuLoader
6ba2ab2afade3c48fb86ce5290a0980f19e901117033cb723cfd48b3ab2c6888
GuLoader
748970d868ca12ef96a98cad33b9f3c7bf7ab20ce2e595d4fdaab152e50b29c8
GuLoader
8db887fade310b044bf413542735e42ea639ba015a1442c1efaac57f6c37628b
GuLoader
a0ef6565b8fed20e76a7fc22c4627c0a62b6d5bdc3b79b7901a00e236060ee2b
GuLoader
a696a4e34ae22386e2759a75b90f5990501c2cbbb529036f8ec124b8fb9f6c77
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
b8c463fc8f8137444b55e4cc24564f539bfe17956a7dde1e4cef2a1d3b9a2856
GuLoader
+ 931 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-8b4962tk9e/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe d29fa6e0fa83a4332afc39315b3961e609bddc91c1b60590c82b009d20cd9f3a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/372236/
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/5496/

Comments