MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a9266bf550d2639f64352c62d4a4f59ac24cadabb6bb459c448935feb2303816. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | a9266bf550d2639f64352c62d4a4f59ac24cadabb6bb459c448935feb2303816 |
|---|---|
| SHA3-384 hash: | 614bdba93880baa6a0bf30389c29d3b16282ca0b6bfe1b2fa3a8d1ac3a90aa485279ff9c5c5bb0439c1be7ff9a0c070e |
| SHA1 hash: | ee7b690528326d96c814b3a9fdb09553824c8e65 |
| MD5 hash: | 1de4fec15df1ef708104676df94336da |
| humanhash: | kansas-ack-helium-oxygen |
| File name: | P527.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 180'224 bytes |
| First seen: | 2020-05-27 13:00:22 UTC |
| Last seen: | 2020-05-27 14:13:27 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | cbaf99f5047f852f388f40518a2a285d (1 x GuLoader) |
| ssdeep | 3072:PiN63Ytxevbv+TBWngfXS7XWAkPT1rFV66AV:PiNyYZf |
| Threatray | 164 similar samples on MalwareBazaar |
| TLSH | 4704A41735F18DDED41E8BF328F39A949E2AAD74560C1A5770397E88E8324E911D03FA |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader SCB |
abuse_ch
Malspam distributing GuLoader:HELO: seed.net.tw
Sending IP: 139.175.54.8
From: Affan Kazi <affan.kazi@standardchatered.com>
Subject: Payment Notice
Attachment: P527.exe
GuLoader payload URL:
http://class.britishonline.co/rss/bin/bin_sEUwdp54.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2020-05-26 22:02:40 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
21 of 30 (70.00%)
Threat level:
2/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 154 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.