MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 02067a8419dc011a977a7f84edb67c3b9e8925248f132d2ee863c5576a29a0b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 02067a8419dc011a977a7f84edb67c3b9e8925248f132d2ee863c5576a29a0b9 |
|---|---|
| SHA3-384 hash: | 8160c0e194998a6a6a7b8fc9eb60a9330b77f2692f2f0ab4bf872cf226c74687a0409c1d16de85c970a08817b8e9da37 |
| SHA1 hash: | ab2b829b70d50810bf883c6531d67567f0d524c9 |
| MD5 hash: | 742c276393159e69859464d8997cd426 |
| humanhash: | ceiling-artist-michigan-fifteen |
| File name: | file.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-08 19:00:38 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 690ce4b547d31c3ac42effb5f9263951 (1 x GuLoader) |
| ssdeep | 1536:bRTuRtSY7LBiOwq5GwMZriaNauYaDc/U5CkfnWdyE66uJA:8rliIrYzgM5CgLZJA |
| Threatray | 5'098 similar samples on MalwareBazaar |
| TLSH | F4933E03FB068702E25A5DB154626BB47717582A08419B2E21EDADDF64F4B23FDEC38D |
| Reporter |  abuse_ch |
| Tags: | exe geo GuLoader KOR |
abuse_ch
Malspam distributing GuLoader:HELO: mail.facetohen.ml
Sending IP: 64.52.164.226
From: Sejunj <michael@facetohen.ml>
Subject: Re :: New Project-Quota 긴급한 RFQ.
Attachment: file.IMG (contains "file.exe")
GuLoader payload URL:
http://slimbosahiyke.webredirect.org//uploud/5bab0b1d864615bab0b1d864b3/bin_INufP107.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Detection(s):
Gathering data
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-06-08 19:02:17 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'088 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.