MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ede635c9e8e470e911dc46b40300cd2e794703cedd0f5487d9677244864741f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ede635c9e8e470e911dc46b40300cd2e794703cedd0f5487d9677244864741f
SHA3-384 hash: 2b739b336b258295cc5088cf71f0317213e7edf64400dea6cd9706f2044b4e94611f3f27bcb0ad4b5fdc993bca574480
SHA1 hash: 277b63b2ed2a03932adbbe95ef5cab75df3c4272
MD5 hash: dd953622b137d4a7be6b81ec143d9769
humanhash: oranges-mississippi-salami-zulu
File name:#0000044567880_BANK_PAYMENT_COPY.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:212'992 bytes
First seen:2020-04-22 11:54:10 UTC
Last seen:2020-04-22 13:10:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 956ee276e5d2a69f00ca57d66564529b (1 x GuLoader)
ssdeep 1536:pX2U8khdmOS6zUlx86Kc2pRsWH29YcHhsWJQZLuQHqkbIgO/Z2yrNTGfq:F2jkhxUe6KRs6msW81IgNUlGfq
Threatray 259 similar samples on MalwareBazaar
TLSH 6A24F842BA70D863C72446306EEAD7BDC2483DE1D9E1851F2050771EEE3379A59A263F
Reporter abuse_ch
Tags:COVID-19 exe GuLoader


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader:

HELO: mail.lumichrome.cf
Sending IP: 193.142.59.100
From: UMC Electronics Vietnam Co., Ltd <vinhbv@umcvn.com>
Subject: RE: Delayed Payment Due To COVID-19 Situation
Attachment: 0000044567880_BANK_PAYMENT_COPY.gz (contains "#0000044567880_BANK_PAYMENT_COPY.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=17BWiKHlfcejUbmN-vR5GRCXiHK4aZ5eh

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-7688398-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-04-22 04:59:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d3pggxe6rzdq5ei5yrvuamam2ltzi4b45xipksd5sz3sisdeoqpq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1d67c5b17b0115be9c9213910f41e052d520c7f86a5b9373f145f8c5f2ded8e4
GuLoader
350b35550e10e3ed50b1337e8899ab2eb9c9cbae7c077027f52bab3c5266bb84
GuLoader
4adf106d80dd2be5d8ea333dcc3a1d06770e4d913b25d05616247f9c66f99484
GuLoader
5c8de7c3ff4d9ad542fe30c13e84cfe205122faefb6427cf7323298eb47ab0d3
GuLoader
7ab96517f6852c124c82edf441496b2f005b11a4d1feb92f9cbfa2a2bffd1acb
GuLoader
7e60af333b52731e98a3c49c7e0ecca12d86c8277f4e6f8f118fd021beb5acbe
GuLoader
8eaeb42b2536dc0cd96ce7b42cecdb5f7097341ee68c73f960e5a426a7f83f04
GuLoader
9b77dffb83a26f126a334f4dd9de9c8a21802a1b05de3067584ebfa25826f9fa
GuLoader
f1e6db23f71358086c0a6d54602989535e6c25309d92af9f0db056d4a372fe8e
GuLoader
f6cbd9ef6fbc0c2774a4bf2e43aa01804ee0294a453e8254f5a843a40051da31
GuLoader
+ 249 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 9fc7a7030997112eb05418ea2486472cce95bef0f321f75f367461930f73afce

GuLoader

Executable exe 1ede635c9e8e470e911dc46b40300cd2e794703cedd0f5487d9677244864741f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/348139/
  
Dropped by
SHA256 9fc7a7030997112eb05418ea2486472cce95bef0f321f75f367461930f73afce
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
MD5 cdee95368f764566d456b0d3ccc5e0b2

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments