MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f345455cae0e8e49f4c68468a461dd2cf63384268e86a5eb78c4b5119c7038f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f345455cae0e8e49f4c68468a461dd2cf63384268e86a5eb78c4b5119c7038f2
SHA3-384 hash: a49c483a5c9b3db935b3340f7a53cd92ee1de2b716b59fa349fad6380e7ffdf4723c751ee7b553faba8f0feb3457542f
SHA1 hash: fa924d31a0031526b35f73e02471dced893a9533
MD5 hash: 793aec78d5f876a470a83aa02e8f891c
humanhash: six-vegan-carolina-emma
File name:793aec78d5f876a470a83aa02e8f891c.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:114'688 bytes
First seen:2020-06-03 13:28:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 018b9bada444e62040320b1e6ac5df10 (1 x GuLoader)
ssdeep 1536:7SPfxV40JU+jy/2b8kgrKHxLdGKc+o0FDHdZ1gIKzG4DM1XslPTF:+PXJybKVdhjFD9zWyH81F
Threatray 933 similar samples on MalwareBazaar
TLSH F5B36B1BED49C553D0444BBD3D178DF93F0CB8194D005BEF663AAE9BAD316422C9B21A
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
GuLoader payload URL:
http://45.143.222.30/MEKINO%202020%20NEW_gbaSkZMcG6.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6314/
Detection(s):
Win.Malware.Generic-7998112-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:20:39 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ncukxfob2het5ggqrukiyo5ft3dhbbgr2dkl23yys2rdhdqhdza._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
3631b6f02663cc48d6ca8a8396a168c0d0204326c8d3ff66b25e013c7e8d5f93
GuLoader
4b1798ea1212bd8c50d111f5124660ca4c7288a1c11129aece16c279a11ab3b3
GuLoader
51f3a9f7ba793e867b3738a3f2707d11d3d839a099a70d6bb02c6b6aa68de4c8
GuLoader
5312fab3ad83a00863c90baec3bbe7f1265cc6d94398b364f2cd7c11369af074
GuLoader
53af62936f7cb4fcbcb2775be40606aed87def8af75821520ebd857dc91370c1
GuLoader
916870a38403e12df5b99954ce22758d7faaec29d338ae29226709c56bcd3d30
GuLoader
dd7268284b041dafef56b6a8a4b565b3a0c54e1eaacc68121a1688e03798e72d
GuLoader
dfc591ce4559101d5c59cf6cc2773496733b1fac5a058529bb093a56298dc8e6
GuLoader
e91763b67687e25f299bfd0b9c30863546f6bc3e1d734c382675ce41ad87b2c6
GuLoader
ff9861dd2b7ce7f396ecbcbbdbff007827a32740243b1b3a848c2566ab32fa59
GuLoader
+ 923 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-zag98mwkxx/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe f345455cae0e8e49f4c68468a461dd2cf63384268e86a5eb78c4b5119c7038f2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/372807/
  
URLhaus
https://urlhaus.abuse.ch/url/373713/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/6314/

Comments