MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d98c94265a32705781c3702b0c93298fe71325cc0d3b8ee5b59a469b412e5263. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d98c94265a32705781c3702b0c93298fe71325cc0d3b8ee5b59a469b412e5263
SHA3-384 hash: 13dfada8ec9f5ee2974da4d6109b2915b1a3181847df511e8957960673deccac4fec1126f88dd94f49e02ad9ef12a38b
SHA1 hash: b718e7a2c2603b4d955076492a6c28d8a73f5eaa
MD5 hash: cb5d5e2a801d0062f57b5130890e53a2
humanhash: oscar-cardinal-equal-paris
File name:WJJ_quote.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-12 15:44:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c3ac2ff892db3523695755c05606b7b0 (1 x GuLoader)
ssdeep 768:QqM1MrY9iOIrrOrHIBpz39vyeHS1qfsV1o2YxGs7wzrhH5:trOI7ztvyDq01Yxcj
Threatray 5'112 similar samples on MalwareBazaar
TLSH D4934A13F6E0E531E2098AB35B2EA79405ABFCB019568D03B5C47F1D3A76F93A52131B
Reporter abuse_ch
Tags:exe geo GuLoader KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm40.hanmail.net
Sending IP: 203.133.180.228
From: 이유빈 <yubin_1218@daum.net>
Subject: 발주서송부건
Attachment: file.img (contains "WJJ_quote.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Fareit-7784794-0
Create hunting rule

Win.Trojan.Fareit-7784840-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 11:08:14 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ggjijs2gjyfpaodoavqzezjr7trgjombu5y5znvtjdjwqjokjrq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
2302aa79bb34eb683a91324995a9fb366bbbe55dffb53deee00b842e75ad19c0
GuLoader
2a40a9e18303875b2db452783190820001c898e8374864fec29793bf43bbe401
GuLoader
420c2572fe66b34a3e994b43ec3d35a60559c2b011c02c038854a99034a9ca2f
GuLoader
b24a5df4c63722afbed1e3807b18fcc065008ec3431de146dbf3657dffa00893
GuLoader
b3b093d992d26b0d21a61a778598abd5dd87649a89f724c2798f60f9dc19de1a
GuLoader
bef21badc9c82be3a2446c61d67213addd54b665d17c4b75b64ec8d9558034f5
GuLoader
c884dcf4fa00359eeb51ead67cd41d9a68b71f09e3588f03456244eddaa36fa0
GuLoader
ceee0c8772c6b5a2cff7d9f3bc824c088f3c7d034b9898c74f79e11b59210257
GuLoader
dc186623afc0375b9ebd176481a9f37268351cac07f2825b8221124ec7ac9edc
GuLoader
fc95c84eb428f263fef3220d512a2f602570f2acb41a46114244c30af48fd51b
GuLoader
+ 5'102 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-smld8z6cs2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img e04103afb750a625530143905db4095fde8d79f4990573496441fc08f2e2a919

GuLoader

Executable exe d98c94265a32705781c3702b0c93298fe71325cc0d3b8ee5b59a469b412e5263

(this sample)

  
Dropped by
MD5 7552ae3db2702e7705112d90b1b6f838
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 e04103afb750a625530143905db4095fde8d79f4990573496441fc08f2e2a919

Comments