MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 182b2d026edb387534dda66711ee6f9050bc8ed871d0ebb71a96f0b18498ba24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 182b2d026edb387534dda66711ee6f9050bc8ed871d0ebb71a96f0b18498ba24
SHA3-384 hash: dff68c8ead40784b5bbf9b5e7242f67aafcd532c1874fa741a8416324d537ed4cf27ddf132c8a07022bd8d521649a310
SHA1 hash: 932d4e3559910e150b7ea8121609ab83f390c412
MD5 hash: f49da27ad6ad52449c2621860495411f
humanhash: two-cola-five-freddie
File name:komm.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:53'248 bytes
First seen:2020-05-28 13:52:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c958342f62abb9a02aa4e5dea0e05a5d (1 x GuLoader)
ssdeep 768:Wjkr5RgFZ2g+7KbtEeg4j2koqKybTFIt:6kFRcRqKDg4jR7Kybmt
Threatray 1'540 similar samples on MalwareBazaar
TLSH B3334B3BFAA98413F38A86710E21A9913A37BD725901AD1B2E44FE5D1D715C3B4B132F
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

From: Salil Johory <dipak@graetfoodgroup.com>
Subject: Re: Wire Transfer Confirmation 100261804
Attachment: Scan0001.pdf.z (contains "komm.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1VDDr13QB-SbZaBWx30W2Z7lMfIeRUu_3

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/5874/
Gathering data
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 14:10:28 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
hawkeyekeylogger
Create hunting rule
remcos
Create hunting rule
emotet
Create hunting rule
gozi
Create hunting rule
Similar samples:
1ed676d7b5902ae99362fbbbd80e7dd2b9cb9c479d9b9a8736f30829e7fe4176
GuLoader
3484fffe14e6d045c8a5c568187f686d4479693dadb3fc4631b7d307000b5148
GuLoader
654dcb8cbaca77d6679523c36f44ea656e39a97ce7e4d6f91b089fe8d54f9787
GuLoader
6591794758496511c22b638fc57b5d58943670a72568dfa92f29a08c501c73d6
GuLoader
82421fe6bfd0fa95f4bc1813c1dbaf3ce1fc505f2e04dafefc653316e0f1f547
GuLoader
b4d2f2e28311317f4e568f4245c251cb0eb314e391223b2077d183e3d0de5738
GuLoader
c689edeb2bea45f5a7e6402ba51dc23e40e6c8b509841f60cb3d7327340b9b60
GuLoader
c87a719713c51891fa7b0def4b093441934d9f60ef8bd52951e2efb9a030f59c
GuLoader
d74d145a490143aa9b5088044bd31e46042dde2522600d119948e7914f1c4a10
GuLoader
ec4b8a8c2223163d74c1c9b97e26889074e995beea8e9a78ba3a8a430fde7bd0
GuLoader
+ 1'530 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-s5pabg3t8e/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 6323f716f78e656da12fad2a6ce9f43437c5e3bde435ae7afa1e0ad4d1245665

GuLoader

Executable exe 182b2d026edb387534dda66711ee6f9050bc8ed871d0ebb71a96f0b18498ba24

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/370301/
  
Dropped by
MD5 cb1548905370762ff38c7462d52deb37
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 6323f716f78e656da12fad2a6ce9f43437c5e3bde435ae7afa1e0ad4d1245665
Cape
Cape
https://www.capesandbox.com/analysis/5874/

Comments