MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04e3c79bdcdc18cb3f7a7aa37ff10534fcd33eebfed20d65b71435fce06986be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04e3c79bdcdc18cb3f7a7aa37ff10534fcd33eebfed20d65b71435fce06986be
SHA3-384 hash: 08c305e9008c8b4f4237380cdfef084890123608cb6bcc90e26810704d003abf3da4e8141d0aec42016f0d98cc08f243
SHA1 hash: 0c5e4e7b4622990d521c41f2547a3f534626c93b
MD5 hash: 116aab2823e0cce6fa37e997c566e919
humanhash: item-cat-sad-tennessee
File name:WT_quote.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-06-03 13:04:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9b51b9645bd6a6da5878d40c35923a6a (1 x GuLoader)
ssdeep 1536:/8SPfxV40t8K1X1lH7BkgrKHxLdGKc+o0FDHdZ1gIDsIAUxjFDm00gDYo:/9PXt3bKVdhjFD9znTigDYo
Threatray 852 similar samples on MalwareBazaar
TLSH 8EB37B03ED4D8653C1444BBD3D178EBA3B0DA80D0E405BEFB5396E9BAE762521CA711E
Reporter abuse_ch
Tags:exe geo GuLoader KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm51.hanmail.net
Sending IP: 203.133.180.239
From: 비 엘 두 주 식 회 사 <dayong92@hanmail.net>
Subject: 견적용입니다 긴급으로 견적만 주세요
Attachment: 2020 06 03.iso (contains "WT_quote.exe")

GuLoader payload URL:
http://ekenefb34logs.webredirect.org/uploud/5bab0b1d864615bab0b1d864b3/wj1_tIaUf126.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/6275/
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 10:36:01 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=atr4pg643qmmwp32pkrx74ifgt6ngpxl73ja2znxcq27zydjq27a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
2f99de0c12f67f877e1944d5bc6f889ff9013fb7e902b91260f4bdc952959d7e
GuLoader
3e3529db8cde73fcdb792f6414ebe6fb9a6ec5ba5cf5f503376a795387b2020e
GuLoader
77b78883671d865b91db205f68f7e5e69c9ad68687f8696f390a9b4b1449090c
GuLoader
7d110a4f6f206b5fb49742150bdbd7ffc43b29a5b2fa32424ef32aa20c4696f8
GuLoader
87f0608e17f3f39e988ac186a431366e1de35968b89943a03f6681e23ab5b684
GuLoader
883f3aee2a5fbc449a9f67c9a35dbbf74ddb22e5e9e8a08c9671407bcf5c781f
GuLoader
97d8ae62cb751e857b04d9eaa68ee2acce3d7243009bdb04639a729cdfc7cbf3
GuLoader
ca1db184290b274c1f78b091bf019926fa258dd8b1f5bb316a55832aec970338
GuLoader
d571629d266c5354146cdfe698d79c88c33e598aa6c8d9a0587662c6b5421ed2
GuLoader
f4a522f673e38bf75d61a8c1c53dc48b36be2c37986259cd8ef7b605fd6716ca
GuLoader
+ 842 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-std4dbtxp2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso d71c896d75cbb094a2a691ce655129041b70f3c5ba9766e85f258162139fb02d

GuLoader

Executable exe 04e3c79bdcdc18cb3f7a7aa37ff10534fcd33eebfed20d65b71435fce06986be

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/374156/
  
Dropped by
MD5 5455ad3e402e8c617633325c85139c91
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d71c896d75cbb094a2a691ce655129041b70f3c5ba9766e85f258162139fb02d
Cape
Cape
https://www.capesandbox.com/analysis/6275/

Comments