MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20b3c1c5495ed7389cb63dfe6f990c7acd72edd8a6e385cbe698702647d44649. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20b3c1c5495ed7389cb63dfe6f990c7acd72edd8a6e385cbe698702647d44649
SHA3-384 hash: 82a351fe972ffea6e979f03a78b6b9eb86d808a200d667554e48e8f54bd9346e45cac41de90f39d52d5fb2931765fbe8
SHA1 hash: 2480ef80014769ab559bde9e308f0bf05e4ed82a
MD5 hash: eec5111005040d12ffc3c4b9ac0cf98e
humanhash: kansas-jersey-maine-purple
File name:P.O 465 Arrow chemicals_PDF.gz.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'016 bytes
First seen:2020-05-14 04:30:58 UTC
Last seen:2020-05-14 05:44:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6944b313dd23d77b69661279c9794190 (1 x GuLoader)
ssdeep 768:X52pD3raHG8xx/6bsdaf3r/rWdhUcPhSA3fd1SZ9:UV3raHG8xGt/SdG6xU
Threatray 1'665 similar samples on MalwareBazaar
TLSH 93834BD2F5D8A973E509CFB05F35CB68566BAC344D028A07B2C4771F2A36E07A46670B
Reporter cocaman
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.PonyStealer.fm0@oqz1Z2nG.23266.11633.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 04:35:29 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ecz4drkjl3ltrhfwhx7g7gimplgxf3oyu3ryls7gtbycmr6uizeq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
guloader
Create hunting rule
Similar samples:
0fad781290e1db5165942e6d7254edf797efcb2dc7712963286e054065be4ec1
GuLoader
1f1745eb2812b5c0cc6c26b69661ea1d8ab78a541271950e7b97d0cd2b502db1
GuLoader
2b419f986ea266fa5826fbb6858782f7c2acfda73aa5ec5cb21d64537d6a4ea1
GuLoader
616b49735927d0f2a78649237770fe83d86db4c50731ac38b8395b85a67ac2e2
GuLoader
890d50ea38e546ea886c5e1d211327e2d4573f3a55f1afc56eacc36ed2187474
GuLoader
ceeffdff4b0af45c77f3923e47c03a529c87dd4e0e92fdc88b0551857df53239
GuLoader
e01f7d5f5a34bc9fde408c3f3fb441b76b6a2c3e2915cbf98ac5ca84e61e2b5d
GuLoader
e09fbb76c70deb9d0d2b2eb99f4d179783e54fc42440c8e478ee834457982f9e
GuLoader
e336780f3321d06dfea57c94467d65e0ab2ab92d77c0267cf17b8d51359a5e38
GuLoader
fe7a6728da6e544a5963774daa1bae063246a1211a815abdb736ea7a31d7bd30
GuLoader
+ 1'655 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-8z3461fkms/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 3ff56dd9c45c74e0dc4e367c07ececf825c4d966cdd59c221edbd8dbbf84907b

GuLoader

Executable exe 20b3c1c5495ed7389cb63dfe6f990c7acd72edd8a6e385cbe698702647d44649

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 3ff56dd9c45c74e0dc4e367c07ececf825c4d966cdd59c221edbd8dbbf84907b

Comments