MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 26d95099636e212fccb35c4865a6aaee393079698b6c3a6f0a07ef2960a845b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 6
| SHA256 hash: | 26d95099636e212fccb35c4865a6aaee393079698b6c3a6f0a07ef2960a845b0 |
|---|---|
| SHA3-384 hash: | fd5dc4bbac3aa44bb53e7e1db846212cea567a5e96e6e4b36846c8fec98ec39dd543c1fcee89390351233933423363dd |
| SHA1 hash: | 395fa0b527c1fddd0d6fd63480feb3b66d68f1b1 |
| MD5 hash: | 01199a22f6dcbcb3332388b2c7832784 |
| humanhash: | double-vermont-papa-winner |
| File name: | Pictures,Images.scr |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 102'400 bytes |
| First seen: | 2020-08-04 13:33:53 UTC |
| Last seen: | 2020-08-04 15:22:28 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 83607e441ce971123637f10227afb414 (1 x GuLoader) |
| ssdeep | 768:Z+FjTlMlWRZ/9doZJ5HIanR5cwbrdenAuSJaay6gTCiOSJuraZ2P/dt7sk2mj:ZMnG+YJOgmtnvGaaq+cJureMuk2m |
| Threatray | 5'225 similar samples on MalwareBazaar |
| TLSH | 64A3D61691E84635F277DFB15D7846E7413D7C38392E858B5EF838AF33B2A098620627 |
| Reporter |  abuse_ch |
| Tags: | GuLoader scr |
abuse_ch
Malspam distributing GuLoader:HELO: vps.hond-red.xyz
Sending IP: 45.95.169.93
From: info@hond-red.xyz
Reply-To: info@hond-red.xyz
Subject: About the Shipments
Attachment: Items Lists.img (contains "Pictures,Images.scr")
GuLoader payload URL:
http://seedwellresources.xyz/bin_dXCUEN226.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
GuLoader
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Signature
Contains functionality to hide a thread from the debugger
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Tries to detect virtualization through RDTSC time measurements
Yara detected GuLoader
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-08-04 13:35:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'215 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.