MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 01f8e3741798998e9bd0a8870adba209817eaa9df6a14ab67875e8292a30c028. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 01f8e3741798998e9bd0a8870adba209817eaa9df6a14ab67875e8292a30c028 |
|---|---|
| SHA3-384 hash: | c56044c9a813b38bf7779150a0a418e392b9f8ef939806ed161a31cdc674c875e18ac2d3969b4858f680f19eac121fb8 |
| SHA1 hash: | 66587c45ad8a39ba15c466ffa939e1ea695c4737 |
| MD5 hash: | f6bafbd6c391df8d2ebcc0b34817b0bf |
| humanhash: | winner-california-india-emma |
| File name: | Tildesheil8.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 77'824 bytes |
| First seen: | 2020-06-08 09:20:21 UTC |
| Last seen: | 2020-06-08 10:22:10 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f210cc1805578f55abc6b9599230ac95 (1 x GuLoader) |
| ssdeep | 1536:eysFY6TjMP1lV3J0goKKzogI8NdFBiBT:zxuQdlV5n1gI8NdFBip |
| Threatray | 1'081 similar samples on MalwareBazaar |
| TLSH | AD739F13EC18D552F0808A756DA24B9A26776D245D426EA73B497EEFFC702C22CE131F |
| Reporter |  abuse_ch |
| Tags: | exe geo GuLoader KOR |
abuse_ch
Malspam distributing GuLoader:HELO: mail-smail-vm82.hanmail.net
Sending IP: 211.231.106.157
From: 화진인쇄산업 <uniprint@hanmail.net>
Subject: 첨부도면 견적요청 드립니다.(한석이엔지 입니다.)
Attachment: file.lzh (contains "Tildesheil8.exe")
GuLoader payload URL:
https://onedrive.live.com/download?cid=809F316B561D99CA&resid=809F316B561D99CA%21175&authkey=AHjVAhLb3L8b4LQ
Intelligence
File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-08 09:22:06 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 1'071 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.