MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcafd8ba263cf7e448be257a8d25c968a0060908f93f9d02a068bb0dd482879f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcafd8ba263cf7e448be257a8d25c968a0060908f93f9d02a068bb0dd482879f
SHA3-384 hash: 1d9853c0aaa71406e304c608852cf7b1dd5b4fb1ce3306342c5ca2275f39c5d826ce4e32ba3b15c3f58f047340c47f0d
SHA1 hash: f9b46f2736d2ef0ba5eb62a6275db69622a11891
MD5 hash: 1fa58038e0360f72c17545f7780494c8
humanhash: blue-nuts-zebra-december
File name:au.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-05-25 14:45:57 UTC
Last seen:2020-05-25 16:12:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3c8bfd9d36ca8647aa191dd4b7b753c0 (1 x GuLoader)
ssdeep 768:o+1/80/HYHGzwRitoPwDOSxJIr7RJhj0qchX0UqjGLG/sqiH4rmTR:5ZdTz+tMLIXW50UqjGLGEqCfR
Threatray 248 similar samples on MalwareBazaar
TLSH 8FB3E813F7C5ACE1ED114FB19CD29F615C2AFD261C422F03B84ABA1E59779812BE061B
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/5582/
Detection(s):
SecuriteInfo.com.Win32.Injector.EMCN.27899.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:45:48 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 30 (76.67%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
2b44eaee1eb9f472580e06b30bc5eba6f513905abe768229ba6290bd1e4da1a5
GuLoader
46387625361cd440a23520b7bda25f402b586d00a44229754ab776e5e1bf34f7
GuLoader
50a5970afc0a5e55eb16da4d20a7f2ab4af3386d58751b276583aad18969ccac
GuLoader
6327c2d28925dd4680b13585501e34181fc4beefaeb08040d1c10fc91a16f0a3
GuLoader
8d6e4671da660a178432514e56aaf7445ea4f03a60f20cc9b6d29826ab435975
GuLoader
b092a330b736b90c25196d0784455f5d605aae83dca16f8569451236204d0976
GuLoader
b5e4950f8979f18ad063f3df3fb483aa88273271254201dbc0e5241b7713edc2
GuLoader
d335fad41e3f9b09effaf617e6c56554b667191c9c94f4b644a15b396408858b
GuLoader
d3aa9fd1ed4af3cc3a49e612b93a03f799ada340c1c086f7403448fe77115bb1
GuLoader
e63df6a7f5c2a30456c884959644745ee0174df416492324c5ee31635958f855
GuLoader
+ 238 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-nvb86yvfhj/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/5582/

Comments