MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8fffa9f88a85c5e0e5344ee431e15c53f9d610019f0746d7a374f59f753593c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8fffa9f88a85c5e0e5344ee431e15c53f9d610019f0746d7a374f59f753593c
SHA3-384 hash: f2fb6e9e0aee6722e6f1ad654b9fc9c8fa53498eaf8401c20ef756a2c59b3a52d315d567b4ef3fee585ef1fc052ad742
SHA1 hash: f461faf998d8e15dd91e06c0529fabc60b456af3
MD5 hash: e30d2ffaa7c7b84a90405bce3a8b53e1
humanhash: hydrogen-lion-diet-nevada
File name:#2020510.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-12 14:05:07 UTC
Last seen:2020-05-12 19:10:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a3950ffe375e513b9b7b6602b93f57b4 (3 x GuLoader)
ssdeep 768:U82eDnuCA5TklNokwma8WbPCEtHR4zSmhiOpY4uA0Y47DX:USD25Tk/okJafbqEsSqY4M/X
Threatray 1'002 similar samples on MalwareBazaar
TLSH 95933B47B2E8D533E6398AF11E696BA8056BFC701A018B1734F1BF2D2B72B13951435B
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
5
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.45746.12340.24339.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 00:14:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3d77vh4ivbof4dstitxeghqvyu7z2yiadhyhi3l2g5hvt52tle6a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
12448a818e7ccebc492215109f9abb94452d760dfea2679461b573e785895ab1
GuLoader
4f965aee8b694528d2d11d5a80eeee466959650ffcd12b5f0fc28d3a11709e27
GuLoader
53e239b6031b90ba0da5ad4913eccc1d651ede3bb4b5c21a02d81387f48303d6
GuLoader
720004239ef0cb716b2f0d8793cfe7fb06d408cd5c598a6c726aab7f21c0bad0
GuLoader
7b0eeeb2adc3fe44102752fbe9a4ed08b3e3bf07fe633f9c3f4ab67eafb6e0aa
GuLoader
7cc0c6e489cb1b2d1dae70339b9409f9a54fa7d8920430490663b6f28ea4a7b4
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
d8893925a5d8f9574be0f322355b79372e9c58dacc1e7737223a7b96e53fe4f6
GuLoader
dfc591ce4559101d5c59cf6cc2773496733b1fac5a058529bb093a56298dc8e6
GuLoader
f8707020bc0b78ae0fab3bd9794993c4cae406d9f13fcb6098f3321cb6bba515
GuLoader
+ 992 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-qzjzbqnsn6/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip cc4516057f64164eb926f936d01434064130e3e9594e0fa838abb4fffc93ce7f

GuLoader

Executable exe d8fffa9f88a85c5e0e5344ee431e15c53f9d610019f0746d7a374f59f753593c

(this sample)

  
Dropped by
MD5 b3083a9696a810e0be5fdf728cf8c8f7
  
Dropped by
SHA256 cc4516057f64164eb926f936d01434064130e3e9594e0fa838abb4fffc93ce7f
  
Delivery method
Distributed via e-mail attachment

Comments