MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4c23bde9d70af07e072c01489007afa4ba4c3672b168e2846f5c2b74c4a9c84a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 4c23bde9d70af07e072c01489007afa4ba4c3672b168e2846f5c2b74c4a9c84a |
|---|---|
| SHA3-384 hash: | 2a8f7a4d88f71b2dc368e697d96486b81bec7e6fcde54bfb2dbce45f685e02ebad4a49532ce4111165a4237aea6db0fd |
| SHA1 hash: | ecbe4f0e941a1bebb6b58c688875dceb82479692 |
| MD5 hash: | 13f5da619a35e85eddc13dd98db445cf |
| humanhash: | item-zebra-august-march |
| File name: | WJ220200602.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-02 11:20:32 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 696a5a6ee1ba0ea781d2664639f5979f (1 x GuLoader) |
| ssdeep | 1536:cAFO8lLihFYaEWgwBbclSLzwK9wXUaTbKxjipz:cLYatgwelUzwmTC |
| Threatray | 5'116 similar samples on MalwareBazaar |
| TLSH | 7E932A077BD58515F1B24B702E7B82996B25BC2A4D829A0F354D1E4B7B307629CAC33F |
| Reporter |  abuse_ch |
| Tags: | exe geo GuLoader KOR |
abuse_ch
Malspam distributing GuLoader:HELO: mail-smail-vm29.hanmail.net
Sending IP: 203.133.180.213
From: 관세법인 영진 <yw5900@daum.net>
Subject: 첨부도면 견적요청 드립니다.(한석이엔지 입니다.
Attachment: WJ220200602.cab (contains "WJ220200602.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1QlyfqBw80FfX4nndjdakVUAjsDuF7dFE
Intelligence
File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Fareit
Status:
Malicious
First seen:
2020-06-02 10:22:00 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'106 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.