MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df645df5428faf2c955f49dc480a266ecb44a8622a0fa6f22b23ff9ab89836b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df645df5428faf2c955f49dc480a266ecb44a8622a0fa6f22b23ff9ab89836b9
SHA3-384 hash: 5aa65b56154ef99332e86c1f47a63c00270bd575bfefc4069f003fd716806ceefef67b9923a921868f00f908b137f5fb
SHA1 hash: 26ebca0adde0c9af63077a70a691b8b5228915f7
MD5 hash: f413a0788bdef774f34dfd4127517515
humanhash: high-golf-don-seven
File name:f413a0788bdef774f34dfd4127517515.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:77'824 bytes
First seen:2020-06-01 13:37:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0e3edd469406cf0a41b1d001df9d5340 (1 x Loki, 1 x GuLoader)
ssdeep 768:1HXuZYbK0/3I96V62OM+UGdZ7hwzEWnjNdHHFl2TEvfgesOuwdUjowzEW:1H+ZYbK0/I96V62OMQdxkH2TZ7W
Threatray 844 similar samples on MalwareBazaar
TLSH 4A733A1EBE489174F06686712459D462BB2ABC3264069E0F72442EAEF871D83FCF1737
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=16PGcnOqpdmPVod3GgYrAqUbw0lWr1lGR

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Lokibot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5919/
Detection(s):
Win.Dropper.NetWire-7993073-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 22:20:45 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=35sf35kcr6xszfk7jhoeqcrgn3fujkdcfih2n4rlep7zvoeyg24q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
2a214959e1a85a4d11444053d4262961ee29e2cc53c3f4ae8f1a59152e5d67f3
GuLoader
32988d9efdef04149dafb7aad85acfc026b906452b1c6a11b5e8402157d20691
GuLoader
6d043b33b33e6baaf7514b9ca56f8dbd8aa57bc71a9040bf438bc780c1a4ad5f
GuLoader
73e1d44799f6f7dff81192f5a25a8fc978f3e1aaf5c94856a94ccc43ef2fc888
GuLoader
7522e963fbeadde98b1486f0d8d2d1a15011812b06d06f1a5bc21caee6876e71
GuLoader
8255284fa792c767fd2464364f12f297fa92a38383d2303d7cf9dcb8b74bdfa5
GuLoader
8bcd0f6cb2c259f22ade6de07f926c2e1512948af545e7a33fd27f784ef12bfd
GuLoader
95b7bbca4d924be150fb6858b8546d3386d44a8a589a7a60ab1a0961718ee84d
GuLoader
d99947df7b80d4cf1f998cd4c205df67be0afc6ab0d9b4d92988b1aeccc1bf0c
GuLoader
daa83b31dedd9baabaa012bf052e93e0b378fd00d7c8f8b18ddd8665e04aeb4b
GuLoader
+ 834 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-l68444scqe/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe df645df5428faf2c955f49dc480a266ecb44a8622a0fa6f22b23ff9ab89836b9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/5919/

Comments