MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f626b5cc65ab623e203f4b4c3b99b4d833726fafd62ce725b6294d3ad8ad68b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f626b5cc65ab623e203f4b4c3b99b4d833726fafd62ce725b6294d3ad8ad68b
SHA3-384 hash: 72e7b7df04a32392d86671e8717a679dd5163db1272fcee3eadcc3ec31c5c8aa782255d7acefe4b0dd789cd0dc2086eb
SHA1 hash: 7473f0b77106ac41af12a4a91db13fa53505cd36
MD5 hash: fb385fd55a2dd00a0037341c4e89a251
humanhash: georgia-august-football-alpha
File name:MOJE-ZDROWIE.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:45'056 bytes
First seen:2020-03-17 12:36:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 72587c9d001a831cb8313a0f6d594a9c (1 x GuLoader)
ssdeep 384:hmccBVCSFxJTxSv21Y3nEKZ+q6fyRM5ZhHvYOC31kJhNCNpIBduF39hpeUr6hxYd:hIBXnSviYUTq6fyRCQdKMo43BeSet+I
Threatray 4'831 similar samples on MalwareBazaar
TLSH 7E136C2FFD36D946E8C88B35794382D89222BD6F4B516C07AD50F31929B32844DE79BC
Reporter w3ndige
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.21592.22087.30609.UNOFFICIAL
Create hunting rule

Result
Threat name:
FormBook Lokibot
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/330652
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-03-17 00:51:00 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b5rgwxgglk3chyqd6s2mhom3jwbtojx27vrm44s3mkknhlmk22fq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
17ccd5b98d29f09cde5b49fee52602ac5e95c462c68f09c5f07d12d8a8cd8e0f
GuLoader
3e1b8febf5f7c0c794dad1a6ae195de982e8c0940997568a370c6fb21511d98a
GuLoader
51ba9fa1830056b815cc4203b57ee4f46b26a5f7dd7f6a01066c94fb88bf8f01
GuLoader
65d993ca9f1fffaa634838468d8f9401f7f2812aa75065e9805447db5b667720
GuLoader
6e85d06aa422cfc42dafe910acf8de96a3224bc6eb8b5af7e7435c0881d7e7e6
GuLoader
a83ded2c7e7d33354eb933f465d2e300c1047bb8470b3bc7beb7dae83228b3e0
GuLoader
ac629d05f42ca29ab1a50f05e5395d53ba37f13e2eef323e4ef98290986bba61
GuLoader
b26b6fd030ce29451797859444a1bd9e0a717b06a2909406e68edf183887632e
GuLoader
d1e9ede488849faab5eb3e767704a4644cc79e6eaac8fe996d90fa164e68f620
GuLoader
f0a859474803c2ba7687f71bdc33ed9296ef1a18920d6c3fb425fc30ae266826
GuLoader
+ 4'821 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f626b5cc65ab623e203f4b4c3b99b4d833726fafd62ce725b6294d3ad8ad68b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 0f626b5cc65ab623e203f4b4c3b99b4d833726fafd62ce725b6294d3ad8ad68b

(this sample)

  
Link
https://drive.google.com/uc?export=download&id=1k5iIo86I_9tca6MgTVAFkaueamKbSbMT
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments