MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 01cbd7ffa69b802c48571c9643d525c525493463b592a79336ee6757e9d54aa2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 01cbd7ffa69b802c48571c9643d525c525493463b592a79336ee6757e9d54aa2 |
|---|---|
| SHA3-384 hash: | b282b9d7b5aa8cfcc49c1fd86e71bed337adceaf964d4f358ab68b968a4e93b70efb44b90a08b15a80ebf92549927610 |
| SHA1 hash: | 305204d80bbff81b558a14187085cf02d81bdb26 |
| MD5 hash: | af9fd9f57d7861b408f7cb322ac94400 |
| humanhash: | kitten-twenty-cola-eighteen |
| File name: | payment inv.scr |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 81'920 bytes |
| First seen: | 2020-06-08 14:48:06 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 859a748b7d5e3f6dc0e299f0f2462459 (1 x GuLoader) |
| ssdeep | 768:Uwu1aL3mNtlrHBOjIHzHKkIlp/He1sHJ/ZTHi6Jbfwa+oT6QOqBvK2rwrso2:XuRtSmzqkIr2sHJ/ZriaTwbTqFK28D |
| Threatray | 5'101 similar samples on MalwareBazaar |
| TLSH | 6C83AE237854C18BF0550BB12CB2DAF43F26BC291941AF8B5155BF5BE872B026CA772D |
| Reporter |  abuse_ch |
| Tags: | GuLoader scr |
abuse_ch
Malspam distributing GuLoader:HELO: wrqvztfd.outbound-mail.sendgrid.net
Sending IP: 149.72.231.253
From: Sener, Mesut <aalbert@svoco.com>
Reply-To: Sener, Mesut <Mest.Sener@irco.com>
Subject: RE: Invoice Overdue & SOA
Attachment: payment inv.img (contains "payment inv.scr")
GuLoader payload URL:
https://ny.libconsult.ca/binazadi_PDqgcY243.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-06-08 14:50:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'091 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.