MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3b9c07ea611e968e7483b8828a480ff7b356a43eab344c984b37930c8dd6417. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3b9c07ea611e968e7483b8828a480ff7b356a43eab344c984b37930c8dd6417
SHA3-384 hash: f2b0647226c5ab1247f81ac33a5a6357430042543de8afec79afebef99557d425c3a57b5197e1b03c7622dfe4bd7957e
SHA1 hash: fac7cd2ea5076ef5f2b52370b3b151fb20f0494c
MD5 hash: a033b4cc63753c2c23ec1dbef1d07207
humanhash: seven-violet-princess-blue
File name:Doc #5489442 PO #463KCBC.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-07 13:41:07 UTC
Last seen:2020-05-07 15:08:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash aacf137245af1ef90000344c9fe16ef4 (1 x GuLoader)
ssdeep 768:259GGr/d2WgXjpACjmPCzqnao8z732d6aXpkED6f2Elir195Y21M:4ck/d2ZXj6uh9o8z7m6a/DOzWm
Threatray 93 similar samples on MalwareBazaar
TLSH 3F93C3A17EA0EE2AD51076F4EB29F29EC351AC715A324D0764C03A1E2F35E279D3421F
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33793839.32395.4123.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 06:26:49 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10e06d6dedcfa52bb09cfb066ed4b5276a6a60ccfc5a6230911ce04b829f381f
GuLoader
47296594a8ffd81843b838555873c6c129bfccd6c211c4033de7cf7523190bd0
GuLoader
623d2dced40110b216c19c5d48ecb250235278055ca3a7192ac98a8640d663f2
GuLoader
7628bdfdefa90c3dde24286daa4292bd93f6a95b9c95ed0e64df8e7df9a13289
GuLoader
8077b9d3b809c1b66793e7292d7afdb401efa60fe9be607bb48a30bcf005af06
GuLoader
969a6ae609d48434fc77838a81d18bd5b93363cea8c1035cb84c091592df8789
GuLoader
b32598815ea88a25f6459ae8b5035d0ed9c787d8fee5f124a24543c0550d9070
GuLoader
b4cb5e02fc90c85a8ec05d9216df64e392f416f6d6fc41366608920c9cbf2466
GuLoader
c8b706bb1149005a7e27ee5f954ef9fc057d3d92197079dd3436c507dca3947b
GuLoader
e80e2cf38bd72bd64cafaaaa0eafc2965bdda90feeb5c153947f81dcdb98e6d0
GuLoader
+ 83 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-w8fwglz1rx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments