MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2215802f5deb432f07a1aeebb7eeeffdf18cc5a035b0315ea693b08a4dbf942d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 2215802f5deb432f07a1aeebb7eeeffdf18cc5a035b0315ea693b08a4dbf942d |
|---|---|
| SHA3-384 hash: | 8ab108089eb082152d66c1a8bce4c931ead1553707e10afb0c368d08a30686ec7ed72bf10058b89b30475ac1621e2be6 |
| SHA1 hash: | e8934c813de802bcf047a09a31e324fd77ef9704 |
| MD5 hash: | ae3b0dc204903f039cbbbe127a0aac06 |
| humanhash: | fanta-oscar-west-fillet |
| File name: | AccountStatement_MandiriPDF.202006011411701.pdf.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-02 07:33:52 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3d05e0e0ac14bd88e77037aa19741ed4 (1 x GuLoader) |
| ssdeep | 1536:UhFO8lLLJo4BqS82LzwKQwktSbr5U8dT:4V38ozwPU/ |
| Threatray | 2'432 similar samples on MalwareBazaar |
| TLSH | 6D931857BAD48502F1B24B702EB782A96F25BC194D439A0F344D1A4B7B317969CAC33F |
| Reporter |  jarumlus |
| Tags: | GuLoader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Gathering data
Threat name:
Win32.Trojan.Androm
Status:
Malicious
First seen:
2020-06-02 04:17:30 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
16 of 31 (51.61%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 2'422 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
042f15a28d97abe600aff5d5a4db9b420840a56eff46184d9986342e932c4b62
Dropped by
MD5 2896cc11ef6147100008312a06e46ccc
Dropped by
SHA256 042f15a28d97abe600aff5d5a4db9b420840a56eff46184d9986342e932c4b62
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.