MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9f7bac168d783095c28bfe48f9ff40079fde45084dbe9aac78eefa54c4cf15ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | 9f7bac168d783095c28bfe48f9ff40079fde45084dbe9aac78eefa54c4cf15ff |
|---|---|
| SHA3-384 hash: | 0f4604e0cd793570756e625c42897212e0a55042ed62320d5f473fba9370fea860595f33ddccecd7412f4d8068635f32 |
| SHA1 hash: | b3e99720cc14c81d6fb024f747af9df3cb793670 |
| MD5 hash: | 5a8e17e8487d19ae6765fd2e83e3ee61 |
| humanhash: | autumn-sad-sixteen-tango |
| File name: | Order_67297791.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 192'512 bytes |
| First seen: | 2020-05-28 07:07:19 UTC |
| Last seen: | 2020-05-28 08:22:37 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 92c3b857848277c1a7d004e016825ddc (2 x GuLoader) |
| ssdeep | 1536:q7lanUapPO+cH/HE5GBQhTWlxqXEht4iuV4foFSyDZWLeXXOGBYmz9OHtZ:4knUCPlkEI6TWlYqu+ADv+tZ |
| Threatray | 153 similar samples on MalwareBazaar |
| TLSH | A2144A327626DCA3DB8546B0DDD2E4F41860BC20CD16CD2BB5C0FF2E357A196A926736 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader Yahoo |
abuse_ch
Malspam distributing GuLoader:HELO: sonic302-3.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.135.42
From: Кунградский содовый завод <lynn.fletcher60@yahoo.com>
Reply-To: Кунградский содовый завод <lynn.fletcher60@yahoo.com>
Subject: Re:
Attachment: Order_67297791.tbz2 (contains "Order_67297791.exe")
GuLoader payload URL:
https://onedrive.live.com/download?cid=10C44A5247ACCFDE&resid=10C44A5247ACCFDE%21147&authkey=AI_x4GZ2DJKnE7Q
Intelligence
File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-28 07:37:52 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 143 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.