MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f96524898a01e5bad30e3d007cd96ba787a25419141210042df0bff2afab6a02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f96524898a01e5bad30e3d007cd96ba787a25419141210042df0bff2afab6a02
SHA3-384 hash: 994c08ca6b3f0bbdabc5611b0edb803cf2dc18659658a76fdcf5e99c7f3bf0b734d31e5130f0bedae02a0bfd540a5a87
SHA1 hash: ea4e342e766985df0ab81327bbecbe326d994268
MD5 hash: eadd7880d7b5bedd0840aab88da3fe2c
humanhash: uncle-michigan-lion-yankee
File name:scan_004768.pdf.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:106'496 bytes
First seen:2020-05-13 17:23:29 UTC
Last seen:2020-05-13 18:23:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b60a92862e5fde2c61caa30bfa062c90 (1 x GuLoader)
ssdeep 768:/E44AG/4yYXNA7Aqp19UsG4Zv8PLY1axtxUjQM/ck+I6H938pNReJfq9H76:P4UXNFqZGgv8PLY+Yckk9sItN
Threatray 1'923 similar samples on MalwareBazaar
TLSH 1FA3B491AFD8E223C5AD4DF6071296A4C8CB6E3F24216F1377C2761EC73A945D2123A7
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.46106.863.24972.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 14:24:10 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7fssjcmkahs3vuyohuahzwllu6d2evazcqjbabbn6c77fl5lniba._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
guloader
Create hunting rule
Similar samples:
045a0ca823585d73272d70c8b35e6a91c0fcbe5221a088f48db5e613a67be2a5
GuLoader
4b610516f134b6efb2100a2e298a70b573be1cd6c4d653af007b907f11ff065e
GuLoader
5a30aa9032bf9eb86209f176404481e70fa108b689330a2544ce0b54fa959ab4
GuLoader
6ba2ab2afade3c48fb86ce5290a0980f19e901117033cb723cfd48b3ab2c6888
GuLoader
983a50787533f7fb48c7aeccfe0cc8ea3b16a76a39b22a1668ef800ed56556f6
GuLoader
ae6a500ab45e86279c34a92c49d12f73716f0a492075180cdad48a761bf38b49
GuLoader
bee2e75a7187b8d59c62e37425a14998512cdc6d5cf0023151ad071f0750f4c7
GuLoader
cebf765590be725ca5f5589e51a0e81236f6e63dae47f1cdff6029429827c0be
GuLoader
eec46d65be09a86f25c891d462671a7a0b3140ee4a8a6ac0a9fa7e1c56a8cb40
GuLoader
f6acfb0076b3a4e817b12f1f4e91eb89dbeeee1bca29d591949b73dfb604ef68
GuLoader
+ 1'913 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-qhsj6ql54x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 6b89b463d444ee7dcbb2abfe879dc1085c4d1925f1affd678360856f5bffc6bd

GuLoader

Executable exe f96524898a01e5bad30e3d007cd96ba787a25419141210042df0bff2afab6a02

(this sample)

  
Dropped by
MD5 48ce3e9f274d2feba45e76bcb3deba49
  
Dropped by
SHA256 6b89b463d444ee7dcbb2abfe879dc1085c4d1925f1affd678360856f5bffc6bd
  
Delivery method
Distributed via e-mail attachment

Comments