MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45172c6f3fbacf815513185a406124acb7e22f367ee212f6618baeef565fe32d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45172c6f3fbacf815513185a406124acb7e22f367ee212f6618baeef565fe32d
SHA3-384 hash: 505e323148a9322ef9d112faf6bb62cf3575823ebfbf02814f530abe3fbb1654c959340c844b467ba8987289ea481af8
SHA1 hash: 2048aafb7583234a46d1d3dc42b86c107f211dfd
MD5 hash: 7c37a5787aab4405d1376aa60ed313fa
humanhash: ten-pasta-don-juliet
File name:PO27052020.pif
Download: download sample
Signature GuLoader
Create hunting rule
File size:114'688 bytes
First seen:2020-05-27 17:16:09 UTC
Last seen:2020-05-27 17:49:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e1f7d30bc837fb80a75f7b0e82de93ed (1 x GuLoader)
ssdeep 768:ALEMZ8XzRLD4f87pmzxNcwi/2dDpf86yknZeGXChNDQY5hg6BhnJdPVryAQ:lXXzR4f8ttL/aDB82e8ChNDM6BNk
Threatray 168 similar samples on MalwareBazaar
TLSH 67B32B03B5D4DC72FC389BB3487185A56D36FD667D140B073509BB9F69326CA2AA031B
Reporter abuse_ch
Tags:GuLoader pif


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: lucky1.263xmail.com
Sending IP: 211.157.147.135
From: Sarah <printlabel@dgshuntong.com>
Subject: Re:Re:shipping box
Attachment: PO27052020.pif

GuLoader payload URL:
http://www.grupopanorama.net/bot_LKVqMwCgtK195.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/5746/
Detection(s):
SecuriteInfo.com.Variant.Ursu.879400.5326.2528.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 17:36:46 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
20f7b18b6a91f3908baaac269777f9067a37e3e2bf5701b822877f3b2b569c0a
GuLoader
3f494d2d90c284f08aedea05b57a4eff483d51efe3a7b5cf9ad26c13f2d7e546
GuLoader
4876d264ad500b3dc254dec660891144c3118a6cc9a229c60d39ff20b584ec0a
GuLoader
52f137c22685d15df043daabdb9c823e07ecec4df42bcc2fa2c5bd45913d32ea
GuLoader
54b35c8b82d20ae8c2cf8204a8a56562364bbca46d434670369c6bd578bdfd6d
GuLoader
82621455e0c9ed9c46f6947beeaf2c5a6962a035eea50b337fad6368b5a6485b
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
c9ab5be38ab7174e733c55d730b50c0e046dafbca139255af8791800a80cd32e
GuLoader
d3a0f59483985809d83304d2336cd23554c8bca976adcb1008cdd529a1e342ee
GuLoader
f2e90acd9eecf1318a331ed9d7459caaff437e46c00ab2757f313d09002a4f94
GuLoader
+ 158 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-3372c98mte/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 45172c6f3fbacf815513185a406124acb7e22f367ee212f6618baeef565fe32d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/369932/
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/5746/

Comments