MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 243a2b578261be1f29edf7c38a2c2b034bdf7b05591d5cbd8d386d3b2d003c20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | 243a2b578261be1f29edf7c38a2c2b034bdf7b05591d5cbd8d386d3b2d003c20 |
|---|---|
| SHA3-384 hash: | 3b7a95807f7b65d90fb2a3e545ae797b5121e9ad1f74ad9703ecaa8d6865e4c2a7968820918e67c8553baf88781c9e8b |
| SHA1 hash: | c460232636c8ae101be7dc0d291ea642350fde19 |
| MD5 hash: | 526e9ed945b7ad90d76f0fa6afed0554 |
| humanhash: | cardinal-low-freddie-spring |
| File name: | INQUIRY.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 114'688 bytes |
| First seen: | 2020-05-27 16:48:01 UTC |
| Last seen: | 2020-05-27 17:50:01 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | bf38c805c93d7021753dd99e8fec9e54 (2 x GuLoader) |
| ssdeep | 768:KyntZZrkDVzOmB5EEoO4w3oh/b011KIEtD526rvOgHwQSX0K7xEOkvu9AqdJh+Wt:rn35g16EouEA1AJ526rjXSR74u9+4 |
| Threatray | 178 similar samples on MalwareBazaar |
| TLSH | 64B3F91779D4AC72EC318BB15975CDA15D76AD312C00AF1B3208BB6D38325CEE9E178A |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: whm.mastertindo.com
Sending IP: 103.103.192.221
From: Howe Robinson Partners/ SNP <snp@howerobinson.com>
Subject: CARGO INQUIRY
Attachment: INQUIRY.rar (contains "INQUIRY.exe")
GuLoader payload URL:
https://cloudfiree.ga/mana.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-27 01:31:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
21 of 30 (70.00%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 168 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.