MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0904d56b0d621156adf1d4449d1b445e6d45eec9c0a4b09e22f9bb95a185955. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0904d56b0d621156adf1d4449d1b445e6d45eec9c0a4b09e22f9bb95a185955
SHA3-384 hash: bb92aa212d9742d42d2acfc9cee2fb03c5ff6da1ffeecbb596483788722695b83fb21c8399521a56bcfc047a1fb8c13a
SHA1 hash: 16e423575192f3846880d53afd2861147804bd1b
MD5 hash: 28609dae15e6afbbaf3c73ac64631eb9
humanhash: cold-maryland-glucose-october
File name:f0904d56b0d621156adf1d4449d1b445e6d45eec9c0a4b09e22f9bb95a185955
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-06-03 09:39:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 30137defffc38c6dd201bcc0d65a1267 (1 x GuLoader)
ssdeep 1536:GeSPfxV40SVFyzkIkgrKHxLdGKc+o0FDHdZ1gIXgWqk+fFSURK:G3PXSVFy1KVdhjFD9z1HYRK
Threatray 600 similar samples on MalwareBazaar
TLSH 71B38B07ED4D8643C1488BBD2C639E7A3B0DA90D4D409FEF7575AE9BAD316422CA710E
Reporter raashidbhatt
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/6241/
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 07:21:59 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6cie2vvq2yqrk2w7dvcetunuixtnixxmtqfewcpcf6n3swqylfkq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
17f52dbf63e20cb471e6da579551830186446d814a14162ec3569c62fb6f0771
GuLoader
3e3529db8cde73fcdb792f6414ebe6fb9a6ec5ba5cf5f503376a795387b2020e
GuLoader
3fdde4c982c6028e222f0b85d1907488540221e55d0d5a8729ea644d90735dcb
GuLoader
51f3a9f7ba793e867b3738a3f2707d11d3d839a099a70d6bb02c6b6aa68de4c8
GuLoader
6f2ed9ee33724651d7fb52edc4dbb3bfde3c19ca12cf5e990952d392305d1c20
GuLoader
77e7fb63d8ead8a0eb26e033cba63599507028ca5a12ea6439f0cf8f9e52d5ce
GuLoader
e91763b67687e25f299bfd0b9c30863546f6bc3e1d734c382675ce41ad87b2c6
GuLoader
ef47e6b46e818e6f3110202391cca1ba74b312d9e2d11dd66e62b59c60b49cda
GuLoader
f2f339adc33d22b8ba865095fd503e028390079aee791e028a36a3c29def7c6a
GuLoader
f8707020bc0b78ae0fab3bd9794993c4cae406d9f13fcb6098f3321cb6bba515
GuLoader
+ 590 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-aef4btwyke/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/6241/

Comments