MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 803e96c5dc273ebc317b62354c790742fbb9807ee577e52790f293ed8298dde9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 803e96c5dc273ebc317b62354c790742fbb9807ee577e52790f293ed8298dde9 |
|---|---|
| SHA3-384 hash: | ff6c15c7f600f8c53154e2b36d102585ff58da1a1007a3d81e130a894ca42948ae29a1db0422a6f755d4b01cba677a0e |
| SHA1 hash: | 55938e981210e66e75c008213e5e8b92caee9159 |
| MD5 hash: | d40270b77c07c1ee01dd66bd468b5c52 |
| humanhash: | mountain-july-vermont-delta |
| File name: | RFQ CTC Group Global 934363Img.com |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-04 15:54:27 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4026f729103b812aae1671acd7a78eea (6 x GuLoader) |
| ssdeep | 1536:ONsMrgz7zyCsIvGMD1wUjYEpMYjqjqj2awnLNOZluu0dUFU5SNFMb8alq2FZU9MJ:Ofrg/GSD1wUjYEpr00NwnLNJdUq5S8br |
| Threatray | 2'380 similar samples on MalwareBazaar |
| TLSH | 71938D92D2F6BA71DF3ADFB21AB05510403B9C2238CF4E0B16F65D782722985B5A3753 |
| Reporter |  abuse_ch |
| Tags: | com GuLoader |
abuse_ch
Malspam distributing GuLoader:From: Titus S Kemp <procurement officer@ctc-group.com>
Subject: RE: Urgent Request Quotation CTC Group Global For HTR 864
Attachment: RFQ CTC Group Global 93437326563.IMG (contains "RFQ CTC Group Global 934363Img.com")
GuLoader payload URL:
https://onedrive.live.com/download?cid=1B5AC29232549D63&resid=1B5AC29232549D63%21106&authkey=ADDxT4gP2p2WZpM
Intelligence
File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-06-04 16:36:40 UTC
AV detection:
11 of 31 (35.48%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 2'370 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.