MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 18e748742879005f647c8928a776023d2a11aa865f34b6ee75adfa5a2abfebfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 18e748742879005f647c8928a776023d2a11aa865f34b6ee75adfa5a2abfebfe |
|---|---|
| SHA3-384 hash: | 5a98f637be18dc438d3bb3c1efe2b931549ab6ccdcbee3d258c89f8b868e36ea945bc126ebda165e432cf6d3585aff45 |
| SHA1 hash: | ccf59429782e49d5ae1a753c4369465582403f25 |
| MD5 hash: | 1db6b268cfcfb4d76aa9eeff46df8c83 |
| humanhash: | sodium-grey-ceiling-wisconsin |
| File name: | PLanilla de Facturacion Mensual 2020.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 114'688 bytes |
| First seen: | 2020-05-26 13:44:50 UTC |
| Last seen: | 2020-05-26 15:24:23 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5403d65e3cd6d9c48854c0bbb2738e19 (1 x GuLoader) |
| ssdeep | 768:L9tj+H/mh6dHBopnYTxx9xaKLoGBrhiyHU4m0h2157VY9ihoN8ZvA8ENrAAAY:JcH/mh6dhVretAtiyHU4mTVQ9N8ZvOj |
| Threatray | 5'082 similar samples on MalwareBazaar |
| TLSH | E1B3D81378A48D73D82C8AB25CF2D5905D6AEC907D520B037685FA6E39763CB6DE430E |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: mail.strongmailvault.com
Sending IP: 111.90.144.220
From: Julieta Campitelli <JCampiteli@newtral.com.ar>
Subject: PLANILLA DE FACTURACION HASTA ABRIL 2020
Attachment: PLanilla de Facturacion Mensual 2020.img (contains "PLanilla de Facturacion Mensual 2020.exe")
GuLoader payload URL:
http://kuroilersuganda.com/indaboski_IuQSk59.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-05-26 14:35:53 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
2/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'072 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.#Formbook
https://capesandbox.com/analysis/4952/