MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1e997f4144eb94f184308c7ebe6dbad709cf7151721c563e43a92d52539d4e1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 1e997f4144eb94f184308c7ebe6dbad709cf7151721c563e43a92d52539d4e1d |
|---|---|
| SHA3-384 hash: | 8d6e0ad3e755b36cedc06933afa781b10d32ef3d1560e4524479e3ece3a5e8b685deccf072b928ff883ecd25eb9e21be |
| SHA1 hash: | db0fe8406888082235b07055cab6f4f504cc1a2b |
| MD5 hash: | ced386ac1c6f3c6ccd513e7d31f5dc47 |
| humanhash: | kitten-wisconsin-timing-arizona |
| File name: | SC_TR11670000.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 102'400 bytes |
| First seen: | 2020-05-21 10:29:25 UTC |
| Last seen: | 2020-05-21 12:25:06 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b6372e4f026d38b9422759b7dbc6aa51 (4 x GuLoader) |
| ssdeep | 768:z2xAFXYujhZxf0gUb3EthvUqdN/B8oMJ1ff0t+nJZhlmAlF/0:qxAFXY03fREEHJNIfQYlmuq |
| Threatray | 5'114 similar samples on MalwareBazaar |
| TLSH | 64A3FB21FB95ADE2CA288EF15CA547A9115FBCA15D018B0B71CB772D2533F82EA70347 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader SCB |
abuse_ch
Malspam distributing GuLoader:HELO: hyperion.1my.net
Sending IP: 202.75.35.117
From: "Standard Chartered Bank "<AdvicesMY@sc.com>
Subject: SUBJECT:Advice from Standard Chartered Bank
Attachment: SC_TR11670000.rar (contains "SC_TR11670000.exe")
GuLoader payload URL:
https://qif.ac.ke/flow_AoGPhiVz245.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2020-05-21 10:36:45 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'104 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.