MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9f0e37176d22221a7d86cf5ba5d17692c55b6eeac3b1197d135cb6ff95a12a0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 9f0e37176d22221a7d86cf5ba5d17692c55b6eeac3b1197d135cb6ff95a12a0a |
|---|---|
| SHA3-384 hash: | b6846e2d2f61653c95ee85ad4f969c67bf30d7b0ad13b0aec59cec706be1738ed834cff1adddf742dc79010e59996a42 |
| SHA1 hash: | ec735da50a3bce0f9c2f35cb4974bfe4d7340952 |
| MD5 hash: | 2d268d5f67d7b5a16e3f4728db52897a |
| humanhash: | single-zulu-aspen-batman |
| File name: | DHL733918737WA.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 102'400 bytes |
| First seen: | 2020-05-21 10:25:01 UTC |
| Last seen: | 2020-05-21 11:15:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4570344c93ae7fe1e01ebf78ab026c23 (1 x GuLoader) |
| ssdeep | 768:rwSSZz04j9V/In1E8rOB47NP/Ku7SbNDRtnvUqVf8PzwpBqIMgQg3RVC3WwfiM//:UTJj//YE6OBS7S5DHvjUCYsQoRafd |
| Threatray | 83 similar samples on MalwareBazaar |
| TLSH | B2A31921BAF4ACB1CE95CDF15D668AE8146FEC7424128E0770CBBB6D1673A41E01935B |
| Reporter |  abuse_ch |
| Tags: | DHL exe GuLoader |
abuse_ch
Malspam distributing GuLoader:From: DHL Customer Support <esivakova@mlproduktion.sk>
Subject: Consignment Notification: You have A Package With Us
Attachment: DHL733918737WA.rar (contains "DHL733918737WA.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=18kKKZ1Yjp0c3QJNcV0NvYQLuYD7zu1Hpn
Intelligence
File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2020-05-21 10:37:05 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 73 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.