MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fa4d6e0887210c5f967d3349942cd846130e5c3c227e56cb0782ec4bc0d9bea5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | fa4d6e0887210c5f967d3349942cd846130e5c3c227e56cb0782ec4bc0d9bea5 |
|---|---|
| SHA3-384 hash: | 1658b717e7f1fdde5ae7d5adf44a35374776fd029134239e17ba112934094eb30c37538337f8f7d2f7b4e60c73d84eb7 |
| SHA1 hash: | e7b0b5c5df1b987dd85bcc0d1914f7ed6a62ea3d |
| MD5 hash: | 0458d927556da0b2b86ab2e723eac3bb |
| humanhash: | ceiling-quiet-romeo-cardinal |
| File name: | DOC2002748785588R894IMG.com |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-04 15:51:31 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4026f729103b812aae1671acd7a78eea (6 x GuLoader) |
| ssdeep | 1536:Z3iMrgz7zyCsIvGMD1gvvvv0oTBuVxyWXynLJVFrAnjIaP+mLVJebVG/Ud43UQ9a:Zzrg/GSD1gvvvvxBAinLxAnj7PTVJebd |
| Threatray | 1'611 similar samples on MalwareBazaar |
| TLSH | 9B938D519AFABB70CD35CFB11A705128983FAC7038C64E0B49E62D386B7AD89B471753 |
| Reporter |  abuse_ch |
| Tags: | com GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: duofil.com
Sending IP: 23.82.189.191
From: Burak Nurlu <burak.nurl@duofil.com>
Subject: RE: ISTANBUL PROJECT-OFFER REQUEST
Attachment: DOC2002748785588R894IMG.img (contains "DOC2002748785588R894IMG.com")
GuLoader payload URL:
https://onedrive.live.com/download?cid=8C77CEE60E33A6B1&resid=8C77CEE60E33A6B1%21106&authkey=AF8H8jn801BJNbk
Intelligence
File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Gathering data
Threat name:
Win32.Trojan.Occamy
Status:
Malicious
First seen:
2020-06-04 16:32:37 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 1'601 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.