MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f315bf6d41eef8afd049d0a665cd82a8b7748c58f5394342d71370c860c97c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f315bf6d41eef8afd049d0a665cd82a8b7748c58f5394342d71370c860c97c0
SHA3-384 hash: e3aff01a3dd03d6a5fbf1da0c89afb539fdaccf889d2a580f22d6cc944d8c9f547a954aef29c2f3258920178536b7639
SHA1 hash: 871eb90ffbeba3ff1b899f50060b62200c484f20
MD5 hash: df6c1b986eab2aa298e0e389fc9eb740
humanhash: eighteen-oranges-august-robert
File name:Payment Advice.bat
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2020-05-20 05:25:00 UTC
Last seen:2020-05-20 05:35:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 89133535fdf449b8614b32074c5dfda7 (1 x GuLoader)
ssdeep 768:DfypD1uSAKHAviosdLp1cUTlnce8riYPOCbykWzqRdaZKFhuREcpQSqmCzAAisF6:LyLjAvj8oa4iYPOAkjpxgc
Threatray 393 similar samples on MalwareBazaar
TLSH C9A31B21F6E8ECA2DE0586BC6F72AAA4005FAC343415DE4F74CF7A5E29F5941A42530F
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.49072.14041.24795.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 04:57:42 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b4yvx5wud3xyv7ietufgmxgyfkfxosgfr5jzinbnoe3qzbqms7aa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
4308487d53d3dc60b85e3aa3ed9753591d34c0ddba9ab1da7e0e9f6117535144
GuLoader
4a1ccc4107466c1cc4454548d16cce5b1104177af32a60ffdf07d5af5f9141ca
GuLoader
4e14841c96a09f5850d1cf5fcb3526714c22d7174e3f75c8a309d8db36ecef93
GuLoader
879e7676629e99b237cfb7781fbeea4442ed20c4c72f1e0a64aa596365c53d40
GuLoader
a183841ad3d2f5ce88d9361676673b77ea0610abac6c5206eba8f12dd8abb8b1
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
ce9d8545eb14f98f81526457b784ada2e37057dae2d74f625e47b4ed10549397
GuLoader
d3a0f59483985809d83304d2336cd23554c8bca976adcb1008cdd529a1e342ee
GuLoader
dd87e9c01a0bf9cc9e8df91cde201e7993643d877029edaa053dda0dd916515a
GuLoader
+ 383 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-5eg4scqeg2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip d38f8c982de3e5e7b0837972845289d63bef4eddacf5c48e6ab61654042cd735

GuLoader

Executable exe 0f315bf6d41eef8afd049d0a665cd82a8b7748c58f5394342d71370c860c97c0

(this sample)

  
Dropped by
MD5 b19f31b86fc0d677c59e0beb278b7fee
  
Dropped by
SHA256 d38f8c982de3e5e7b0837972845289d63bef4eddacf5c48e6ab61654042cd735
  
Delivery method
Distributed via e-mail attachment

Comments