MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 080a382d362b7bc36365a369f6ff5755a38641e021fce3225eeda8e10e54964f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	080a382d362b7bc36365a369f6ff5755a38641e021fce3225eeda8e10e54964f
SHA3-384 hash:	216cf4b176848e612ded2ad429d28b9064ef6c1f03cddb6fbee7904ff0b6319911428351af6d741af0997d42e0fb113b
SHA1 hash:	234d7a559b2f7acab028e66b34903a6145ebfc7c
MD5 hash:	8395c6119e94cccc34d61f117cfc4f4d
humanhash:	potato-sink-neptune-lima
File name:	FA.202006.1995.DOC.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	73'728 bytes
First seen:	2020-06-09 06:41:41 UTC
Last seen:	2020-06-09 09:09:38 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ebbe548dbcd71cc671c8b0b9c1a73ea0 (1 x GuLoader)
ssdeep	768:bBgAu1aL3mNtlrHBOjGeXeI8fAWE8rGat8oZTHi6JKZmuKuForjDRZuXJEvr2W:bGAuRtSaSe9rTWoZriaLW2RZuXGD
Threatray	1'410 similar samples on MalwareBazaar
TLSH	F3739E13AD04D157E0140670ACA39F693B9A7C7C5582AF4B21DD7F1FE9723926CAA23C
Reporter	abuse_ch
Tags:	exe GuLoader

abuse_ch

Malspam distributing GuLoader:

HELO: myuncommon.favour.com127.0.0.1
Sending IP: 2.56.8.246
From: info@vinco.cc
Subject: Pagamento Recusado
Attachment: FA.202006.1995.DOC.img (contains "FA.202006.1995.DOC.exe")

GuLoader payload URL:
https://onedrive.live.com/Download?cid=3BCD34D8AC2D7789&resid=3BCD34D8AC2D7789%21435&authkey=ADMsJhgPkBTcqZs

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/7256/

Detection(s):

SecuriteInfo.com.Variant.Razy.682490.25533.4472.UNOFFICIAL

Gathering data

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-06-09 06:43:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bafdqljwfn54gy3funu7n72xkwrymqpaeh6ogis65wuocdsuszhq._file

Verdict:

malicious

Label(s):

guloader

GuLoader

2d49b1fe3da354221f225b3d9f99647f41c82eb2248acec1d79ddf62422f6f43

GuLoader

34c9285a6b094968258fffe94cb3339c1715cbc6b8db1d309f7075eb0afda2d0

GuLoader

77ca94fab37626c559f533cfa3588472cd3578c3f334b4377e98e5b53cdf5782

GuLoader

8bbc2e9322af7c28162adfaa66055af70695b2da16b822be4b8b4deb67da405c

GuLoader

93dc44981a771519cbdf592c8391ada5234cd2f6c19fc0bb4b3233867db9a345

GuLoader

aa82601b73b942480ec35f665f346890e2d2b51646b89b77a36efed5962527d7

GuLoader

b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f

GuLoader

d11f49cceb75957df9dde57b197a71b081579d2a63eaf294974e5d03dbb6a558

GuLoader

d213c80671d27596824def5ecb513b07e2118bd110e1230ed68aa4daab49bcc6

GuLoader

+ 1'400 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-bh5h3pm7cj/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of NtSetInformationThreadHideFromDebugger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_vobfus_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator