MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d159f3626adf62282b20470b72d2d93408da1cc30bdc4df23030fe77e2c992f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | d159f3626adf62282b20470b72d2d93408da1cc30bdc4df23030fe77e2c992f8 |
|---|---|
| SHA3-384 hash: | a58158b93ac5b36f238493c16d47e094f04cb79bbb7c6e09c9e0c73d7c683db91d96e1e07ba311909fdcf195435ab98f |
| SHA1 hash: | 8d8a24bdb23854ca020cea86e6c75dc822729c14 |
| MD5 hash: | b0dddfecc539fff352942b36b9f4a29a |
| humanhash: | undress-artist-ink-six |
| File name: | PO. DIC-SAB-213-001-T-0023.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-05-21 08:16:13 UTC |
| Last seen: | 2020-05-21 08:53:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 55296fd5d744fc5bac1615e265983ec4 (1 x GuLoader) |
| ssdeep | 768:s3/q8A6U81Bn7//qtvG9HezkA0JQgApdLqambREk15zh+FE:s3S8jhutIHeL0JCd+am9h15ke |
| Threatray | 5'112 similar samples on MalwareBazaar |
| TLSH | 49933A23AEBA6EF0F9B547B28C3295162427FE7004554B1B65CBB90D0B339CBED60716 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: mail.moenepa.cf
Sending IP: 94.177.242.245
From: MAN Energy Solutions Korea Ltd <jkahn@cmcoeng.com>
Subject: Pricing Quotation Request_Brazil NW LNG Energy Plant Project
Attachment: PO. DIC-SAB-213-001-T-0023.exe
GuLoader payload URL:
https://www.jennydemalaga.es/vlad/bin_MxGuGYIDso13.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-21 04:30:50 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'102 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.