MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fe0e6e3be607ade9869e9d5a06c87f2485aaf35a29691f74354d7e6a386e711a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | fe0e6e3be607ade9869e9d5a06c87f2485aaf35a29691f74354d7e6a386e711a |
|---|---|
| SHA3-384 hash: | 89a807f50791d9e01ff8a6133d8868d6b6c40e3869924238e29e6223d02771a3b1bec6813eab7cb6c5102ff6b48aefe0 |
| SHA1 hash: | 6c145a44a207fd210bddc3aceba5d20548feaa25 |
| MD5 hash: | 31a3161bd46458175f1594173b694edd |
| humanhash: | ack-florida-pasta-fruit |
| File name: | account statement.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 143'360 bytes |
| First seen: | 2020-05-27 18:26:20 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f379f6ed3a36e399fabaea2f569cb0a5 (1 x GuLoader) |
| ssdeep | 1536:ktVQnQUzqKSyhLLXI+CPMX1XzrA4GkuDo53dnddrofR98GNe:ksQoqPye+SMRzKpo5NndSfx |
| Threatray | 189 similar samples on MalwareBazaar |
| TLSH | BFE375127DE66C7DD1897DF16C9568AA2A062C10BF04176F22C5FBBD72318F12CA171B |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: slot0.boellhof.com
Sending IP: 45.95.169.21
From: Mail Server <admin@mailbox.com>
Subject: You have pending messages, release now
Attachment: release messages.img (contains "account statement.exe")
GuLoader payload URL:
http://185.205.209.166/wext/Rem-Stub23_tkxlq56.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-05-27 18:37:51 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
17 of 31 (54.84%)
Threat level:
2/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 179 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.