MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a482ba55509a726553b330a4c2fd71e6142542ddff387c0c34700ea0835ef9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a482ba55509a726553b330a4c2fd71e6142542ddff387c0c34700ea0835ef9b
SHA3-384 hash: 66041ef75040e51eb0113c85de6b7ecf4d132dd60cf7c68114bb63f36e9b298f5a2993e87676df651de6985e0bd9e606
SHA1 hash: 6bcfdfe7efb9c21b3898557daca099c4c95e1953
MD5 hash: f3dd3b4e92b3ad2319680b3a47b3cd7f
humanhash: bakerloo-yellow-delaware-coffee
File name:Factura 78689.pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:43'502 bytes
First seen:2021-04-13 05:47:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:nz6FCcRHgPMh+snAEBkbqenAKxwh/xtAoA355S:nmFRHN+BgenTwpxWp5S
TLSH B613027E0542FB94158D594B2F66DF55AC2C00F58BA83AE77316B03F50CE0AE45B8F86
Reporter fabjer
Tags:rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a482ba55509a726553b330a4c2fd71e6142542ddff387c0c34700ea0835ef9b/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-04-13 04:43:38 UTC
AV detection:
13 of 43 (30.23%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjecxjkvbgtsmvj3gmfeyl6xdzquevbn37zypqgdi4aoucbv56nq._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader guloader
Link:
https://tria.ge/reports/210413-npyh4safcj/
Behaviour
Suspicious use of SetWindowsHookEx
Guloader Payload
Guloader,Cloudeye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a482ba55509a726553b330a4c2fd71e6142542ddff387c0c34700ea0835ef9b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 0a482ba55509a726553b330a4c2fd71e6142542ddff387c0c34700ea0835ef9b

(this sample)

GuLoader

Executable exe c2c1253d4a7c1f69561044a12333f93b9a5219b9ee4555491085d978814ae0de

  
Dropping
SHA256 c2c1253d4a7c1f69561044a12333f93b9a5219b9ee4555491085d978814ae0de
  
Delivery method
Distributed via e-mail attachment

Comments