MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15bd43191828799355d6009ea83dbfedbde843ce346321a6db7eeb61eb687d88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15bd43191828799355d6009ea83dbfedbde843ce346321a6db7eeb61eb687d88
SHA3-384 hash: b0e622f557d2eab434eed5afb9943c391f387752a9582b8aeda4af42785644c13bb4fa6830af4f53956c37173ae4bff3
SHA1 hash: ba23809b395af1575fe55adb78c965d5a2729567
MD5 hash: 84de8744bf733d842290abe912a8465b
humanhash: cola-ten-arizona-happy
File name:DEUTSCH-BANK TELEX 45,000 EUROS.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:114'688 bytes
First seen:2020-05-26 17:30:30 UTC
Last seen:2020-05-27 05:26:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ca4d17bcfbc555c7852e7040586e9cc8 (1 x GuLoader)
ssdeep 768:QFnhafsJp/NLHD+paxdx+yPPlH4oZ+Kqb+wBAgDxCFEBYbQxgs3/oGl4F2SPnbVd:Ewf8VxHPZ4oPOcbQxgsvozVDVYBvu5
Threatray 827 similar samples on MalwareBazaar
TLSH E7B318237CD48CB2D86E8FBC98F1C55A0EA5AD246D464F077505FE9C29B638B24B1386
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: WIN-RF3QMXUZ2NO
Sending IP: 103.89.91.124
From: EMAIL ADMINISTRATOR <admin@moleaves.tk>
Subject: YOU HAVE 3 PENDING EMAILS, DOWNLOAD OR RETRIEVE NOW
Attachment: Pending Messages On Email Account..IMG (contains "DEUTSCH-BANK TELEX 45,000 EUROS.exe")

GuLoader payload URL:
http://185.205.209.166/wext/Rem-Stub23_tkxlq56.bin

Intelligence

File Origin
# of uploads :
3
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/4932/
Detection(s):
SecuriteInfo.com.Win32.Injector.EMDK.12449.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 17:35:41 UTC
AV detection:
21 of 30 (70.00%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
remcos
Create hunting rule
guloader
Create hunting rule
Similar samples:
0b8d469babc7b057403a1d7ca0f781c9a675523941cfcc8bb6eae582680746c4
GuLoader
40838317f53ebe7b37fab29e95826e44ffd7eb7b349e8bed0f5d7ae5db013df1
GuLoader
4692d4716a224f54c928808d2d7ee7e9eaeb8531f1cd29b91886fa511a12f07a
GuLoader
487032be06deec0a6b50c6c0464edb67d50f9bb769ea1527969d4b67b83e8733
GuLoader
59b1b0e770b3b964f7ad3290b9ebfa845b828c7819cf8282b2b7aa89530cff78
GuLoader
60201a00a9f96b8efea761e31e3483a7a5bfd04ad66f766b3dd7b24e00664069
GuLoader
a7d93e9c9bb80f0f8a271ae4a101f305bac535e197697b35f291794fa83ef538
GuLoader
c689edeb2bea45f5a7e6402ba51dc23e40e6c8b509841f60cb3d7327340b9b60
GuLoader
ca1db184290b274c1f78b091bf019926fa258dd8b1f5bb316a55832aec970338
GuLoader
e138622ca793f4a546496b40dcf406a83aa667d16fa2a29879d8282a39d6e7ff
GuLoader
+ 817 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-s81s7151qs/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img e2fe1cf05cf200c62116e94f64a9b1453427884f4d36de3a4bd138f5a12c2eb1

GuLoader

Executable exe 15bd43191828799355d6009ea83dbfedbde843ce346321a6db7eeb61eb687d88

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/369580/
  
Dropped by
MD5 cd5328e7c7fb8435f94a0f8a4abe3cf3
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 e2fe1cf05cf200c62116e94f64a9b1453427884f4d36de3a4bd138f5a12c2eb1
Cape
Cape
https://www.capesandbox.com/analysis/4932/

Comments