MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4
SHA3-384 hash: fbb4f879d3f2a040b6bd7f0c7e8ee1c8621cc91c051e59d2ed554ead84ad1ef9fe6168e52caae097ab90a2dd660e4e89
SHA1 hash: 5b9ca74f20e9db78f159f613edf15d2596dcb8e9
MD5 hash: 76390b2700d20925f6372f1302eca538
humanhash: magazine-lithium-network-snake
File name:SWIFT TRANSFER COPY.pdf.bat
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-22 15:04:47 UTC
Last seen:2020-05-22 15:48:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c2d4474df1bb9123c0455d0bf495a4ce (1 x GuLoader)
ssdeep 768:Tz+KtZa61wBpdMJKWOXl1T/eyEXPqHIzM3HctpLPmXCN1taJxqHhxCPzmzLry98:n+3VBp2JN4XoXC3HMTxwmvt
Threatray 721 similar samples on MalwareBazaar
TLSH C79319327690DD96E5298FB00D7687680477BD791A000F1B32CD3B5E6D33A8EAA7135B
Reporter abuse_ch
Tags:bat GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: pro03.emailserver.vn
Sending IP: 103.15.48.223
From: ACCOUNTING <kt_1@achison.com>
Subject: RE: Payment Receipt
Attachment: SWIFT TRANSFER COPY.pdf.r07 (contains "SWIFT TRANSFER COPY.pdf.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1zpSdW4Tji4URCA69dGKz-v62r_7LJazk

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 15:35:50 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 30 (66.67%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1d117728ec260d80f6c6a347c4c32c965c69ff10bd4f08444fc70e82eebb1094
GuLoader
2e4e588077024fa1b6e3a621faef00f099fdf962d850adc1895cd0d878a1e8d7
GuLoader
460a85fda060cc0c8ab5a1aace37dc1f14bc400f4a3b011e613f64e0000c77b6
GuLoader
64e277226ed8348102a4af90ee5cfd3624712a5376c447e16b72377c9d6c3acb
GuLoader
6c318da83e3d6644f8e3cfc7b57627970cbbd6a607c7c6e661c3bdb9bd20ba44
GuLoader
a57304043cdf4e54783b99ba437e2dedc5bded49da0878e17c459ba37e41bb55
GuLoader
b5e4950f8979f18ad063f3df3fb483aa88273271254201dbc0e5241b7713edc2
GuLoader
baac016255a128a1209211bba2a47979f3392f12c41d5805469f899eba6de47b
GuLoader
d3aa9fd1ed4af3cc3a49e612b93a03f799ada340c1c086f7403448fe77115bb1
GuLoader
dcafd8ba263cf7e448be257a8d25c968a0060908f93f9d02a068bb0dd482879f
GuLoader
+ 711 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-rbhfs2k7fs/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

r07 d45cb0cc3ad0cf6ffe10da946aa402b9e227fb0ac2a989e37904c8626c34c2c0

GuLoader

Executable exe 6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366785/
  
Dropped by
MD5 35029684e39cf6975e9f1345ea9f6b7f
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d45cb0cc3ad0cf6ffe10da946aa402b9e227fb0ac2a989e37904c8626c34c2c0

Comments