MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e03bbbeaae0ac8eec422f94d9bf960cf975e54d41059cca1118c6a06672ea364. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e03bbbeaae0ac8eec422f94d9bf960cf975e54d41059cca1118c6a06672ea364
SHA3-384 hash: a70c6afb3db944d1c998993b4ed279d7d3ada1ff16684c1eb29af0cc517d401f0fbaa1df578a9964398cb801146a2f2e
SHA1 hash: 133ccdb195ee938b5ec0f3b9e235fa820b1ce36d
MD5 hash: 2bf7b6cce08dd1c7ae78a85238ccfe26
humanhash: arizona-november-july-magazine
File name:e03bbbeaae0ac8eec422f94d9bf960cf975e54d41059cca1118c6a06672ea364.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'016 bytes
First seen:2020-05-04 04:23:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash affd1ffd1e7712e66f41a230da3a834e (1 x GuLoader)
ssdeep 1536:P3wgaEovmTS8Whzai4fKdkrQTyn12Pi/Tq:BaEovetWFKAkec2PQq
Threatray 596 similar samples on MalwareBazaar
TLSH 4A830811B284FA32D5284AF43F2492F425B5BC304A534E3779807B2E6532EA7F6603B7
Reporter JoulK
Tags:exe GuLoader Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 20:14:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4a53x2vobleo5rbc7fgzx6laz6lv4vgucbm4ziirrrvamzzounsa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
08573c8eb12aabb14b6645a6630c8ab937bc9e36e1883d23062bfca41bb438e8
GuLoader
138c7976b6b5a29a4569f5018d6b925548a9a424fe3a48293f8a1522ba639afc
GuLoader
4729e8e24dbf89c9ac42039bf7c462a3cdf0fe732b981eaa566cbd03a6cb4268
GuLoader
623d2dced40110b216c19c5d48ecb250235278055ca3a7192ac98a8640d663f2
GuLoader
712e43ae7f3f228367ad7a3208bd6f1c1f38628a699a22dd3e2744545b724344
GuLoader
d184268bf1ee860b491b319eb7f96adcab1a9ea696ffb4c26449a60c33b7a9e3
GuLoader
d3e1f5cc557fedb2c060faa7f234f4a09ba408c428e1c2275b2e713e0bf68db7
GuLoader
db1a6e4c123218f4eb1bbf4720dd0ac58ceb2ba667d5c987c5e83c45de560f35
GuLoader
f3b9c07ea611e968e7483b8828a480ff7b356a43eab344c984b37930c8dd6417
GuLoader
fcf4597470e4342ddf7911195ac0069baca4dcef90e31c0bbd889153312c9ba5
GuLoader
+ 586 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-enhmyzwjrn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments