MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1ca43e5c33edbf126b18cd7603f5674dc45c9aa2d34efa41796a8f0f9a08b947. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 1ca43e5c33edbf126b18cd7603f5674dc45c9aa2d34efa41796a8f0f9a08b947 |
|---|---|
| SHA3-384 hash: | bf18df627a17f2e6b9976ed8b76c3260c41aa1b4e2bf0ce771fdb91457a8450da6ec2eac512c17a7208220b899203541 |
| SHA1 hash: | d78e9d3a6f1d3ab063380eeb614e08a60a0b44b3 |
| MD5 hash: | e81d3d5df9ebbc49b83ad08b2a4faa78 |
| humanhash: | oven-berlin-massachusetts-zulu |
| File name: | ORDER_290320.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-02 11:18:12 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | cb1f511efef408a16db0cb8f143c6f7b (1 x GuLoader) |
| ssdeep | 1536:gkFO8lLgOwIGURSTlBTn3Bl+LzwKQwMKrXG9jmd7Qln:IIGUQlJxlAzwPBZx |
| Threatray | 1'495 similar samples on MalwareBazaar |
| TLSH | E593F7077AD48601F1B24B706EBBC269AB25BC1A0D439A4F354D594B7B317629CAC33F |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: yisun.co
Sending IP: 111.90.159.196
From: Talisa Warnes <Talisa.Warnes@yisun.co>
Subject: RE: URGENT ORDER AND PACKING INSTRUCTIONS
Attachment: ORDER_2903201.rar (contains "ORDER_290320.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=112xgzHgHWSXJwlWbQPo220usZkbOvsec
Intelligence
File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Fareit
Status:
Malicious
First seen:
2020-06-02 11:37:08 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 1'485 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.