MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 08b47c6d183afb72f383ced4639ba73a03d9b36f06617585b3a3d28b69d1ce9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 08b47c6d183afb72f383ced4639ba73a03d9b36f06617585b3a3d28b69d1ce9f |
|---|---|
| SHA3-384 hash: | f4b21b88181a0bbfb57950e7beb3a7577abf02b62d4a03b665f6bb53e4f4964c87ab0238afd28beda73d79c4e1646542 |
| SHA1 hash: | a5e126f740869097e2ce6647eaa11e7ee185e28a |
| MD5 hash: | 8fca60d0248df06016abdab9262d7d12 |
| humanhash: | apart-avocado-monkey-nuts |
| File name: | list.dwg.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-02 10:59:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b2c2ba3c1fb1d585bc8a9256f23e00b5 (2 x GuLoader) |
| ssdeep | 1536:XtFO8lLrPUGDeWGi+BJY8GLzwKQwTe3TuR3mJwjU:YQb+I8YzwPwm |
| Threatray | 5'161 similar samples on MalwareBazaar |
| TLSH | BB9307537AD48501F1B24A712EBB93996F25FC1949839A0F344D198BBB307669CAC33F |
| Reporter |  abuse_ch |
| Tags: | exe geo GuLoader KOR |
abuse_ch
Malspam distributing GuLoader:HELO: mail-smail-vm44.hanmail.net
Sending IP: 203.133.180.232
From: 로이 유 <farmsco@daum.net>
Subject: 견적요청의 件:HYUNDAI MASS QUARANTREAT PROJECT
Attachment: HYUNDAI MASS QUARANTREAT PROJECT.dwg.cab (contains "list.dwg.exe")
GuLoader payload URL:
http://ekenefb34logs.webredirect.org/uploud/5bab0b1d864615bab0b1d864b3/smik_DmaNZPfC106.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Status:
Malicious
First seen:
2020-06-02 07:52:00 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'151 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.