MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3371cb1ea5c1990f19e0141454e418ba8e30d70c140d5f4cd3e797aa80a9bb9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | 3371cb1ea5c1990f19e0141454e418ba8e30d70c140d5f4cd3e797aa80a9bb9c |
|---|---|
| SHA3-384 hash: | 19ce50037ecd98c135c32d811e8679262052710ceadfeff61000eb88a29075f2eb633f070434f4a9e856b8f29c2fa26b |
| SHA1 hash: | 6dd1f493400987c2985a373cfe936d709de1ce9d |
| MD5 hash: | 2d7f2df4220cee32dee1c8acb91ba4a2 |
| humanhash: | ink-venus-kansas-april |
| File name: | gunzipped |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 196'608 bytes |
| First seen: | 2020-05-28 13:17:41 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | a21af033676a50847cb917ba09b1adbd (1 x GuLoader) |
| ssdeep | 1536:YvjWcRNWQgoGZsO4NcOe+jWfreKHOFTb1udOxLypx0XM4yxO5rX3m+l+NLcZKo:qSc2RZs1WfreFX1udyyHibywx |
| Threatray | 418 similar samples on MalwareBazaar |
| TLSH | D1143A36B667DCA3DA8549B0D9D1D4F40469BC20C8468A3F72C17F2E36B61D39862B37 |
| Reporter |  abuse_ch |
| Tags: | GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: ggkorea.co.kr
Sending IP: 192.129.189.208
From: Veronica <veronica@ggkorea.co.kr>
Subject: Re: SP 21 Woven Top/Dress Fabric Follow Up
Attachment: doc05282067665898688.scr.z (contains "gunzipped")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1qJ1bywJ84j6KAC1qYO9XPmviM6AS8b64
Intelligence
File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-28 08:04:57 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
26 of 31 (83.87%)
Threat level:
2/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 408 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
persistence
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.