MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 20068144ad483092f7d01af361be58762ae467679dd012a35bc11e5cb86c6c85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 20068144ad483092f7d01af361be58762ae467679dd012a35bc11e5cb86c6c85 |
|---|---|
| SHA3-384 hash: | 5ac69b890cb644c3d83f7004d116136b7d5281246e43fe11a9a05f23be5c1020ac06d69faa3428cdd7112ca139f52b45 |
| SHA1 hash: | b953ecb63b0f833bf7cfc25d8384c4f76c95afd7 |
| MD5 hash: | 120f0f1237b289fe38dabd4ffdac3a24 |
| humanhash: | one-enemy-delta-uncle |
| File name: | Dyreryggesselvhjlp.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 90'112 bytes |
| First seen: | 2020-05-26 13:33:56 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 705b01a429c29b7cff5a65ece9547902 (1 x GuLoader) |
| ssdeep | 768:tEawKJPylRGZ/aT1Q0tB4/MIo7JE2eO6OCoUJJak/6DmsyDd6BkEiM3LBTofn:znUA/yC/twtBtFk/6yjDd6B9Z0 |
| Threatray | 446 similar samples on MalwareBazaar |
| TLSH | B2932B27BA794013E31746FA1DE35E926A327C320C025E177588BE5D1AB9E43B4B532F |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: slot0.unsthows.com
Sending IP: 45.95.169.135
From: Feng ltd <info@unsthows.com>
Reply-To: info@unsthows.com
Subject: Price for Stock Offer
Attachment: Dyreryggesselvhjlp.rar (contains "Dyreryggesselvhjlp.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1ys9kSljf6cOP09XrRnxgtE6LoHH7Ttpj
Intelligence
File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-26 13:36:17 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 436 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.#NanoCore
https://capesandbox.com/analysis/4963/