MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26fc46f356639b8fe74cd3df54e1416d07d225950c846bf166f3679152a8e5a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26fc46f356639b8fe74cd3df54e1416d07d225950c846bf166f3679152a8e5a0
SHA3-384 hash: cb364f3b0e8ae4142cb656513c1a4e206a452aa95cba31efb508f0463a204d9d6ab7779d8285ea382c57721931f4eaa2
SHA1 hash: ebc5342668149035aae67804c581d28e7d95aee4
MD5 hash: 8389fc18d76cc0a9d250f9da7dbfdc1e
humanhash: foxtrot-emma-lemon-tennis
File name:견적 제출건(저스트)HYUNDAI MASS QUARANTREAT PROJECT.dwg.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 06:51:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0295816114ce7e0b48ee9713a3412446 (1 x GuLoader)
ssdeep 768:b2f5GMjJvbviBpxfgMyuHz5O0j0O9Cqhoi5z+eMT6qu:b65G0ExYMR4OXhQ
Threatray 877 similar samples on MalwareBazaar
TLSH FB535C5B6D18D953E1B08BB02D22D1A56325BC286502BE477E9C7F2CEB711C27ED331A
Reporter abuse_ch
Tags:exe geo GuLoader KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm50.hanmail.net
Sending IP: 203.133.180.238
From: 로이 유 <km4216@hanmail.net>
Subject: 견적요청의 件:HYUNDAI MASS QUARANTREAT PROJECT
Attachment: 견적 제출건(저스트)HYUNDAI MASS QUARANTREAT PROJECT.dwg.dwg (contains "견적 제출건(저스트)HYUNDAI MASS QUARANTREAT PROJECT.dwg.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1MlZro8vkFl7QfSDJyCrAhonEAsXg334X

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7471/
Detection(s):
Win.Malware.Malwarex-8014471-0
Create hunting rule

Win.Malware.Malwarex-8014474-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:52:13 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e36en42wmony7z2m2ppvjykbnud5ejmvbscgx4lg6ntzcuvi4wqa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
2a058410467d9a9aca36e588d9e3a0436b90b949c352f05ace83aa244e2567a2
GuLoader
2c27feaca7c04d48cd54730df7e4c89dc200d18658fd78c6a3388a94f15dca9b
GuLoader
345ed143bf3a28f74de72fa62a271a67fb28ae04e6ca0fefa8eb09c7782dc3e6
GuLoader
6d043b33b33e6baaf7514b9ca56f8dbd8aa57bc71a9040bf438bc780c1a4ad5f
GuLoader
8b791216101006bea031bc4ff657001f95cd58ed1db4429a242d79050f947d40
GuLoader
90a94255c2017221edd00cc99acd98a33e112e1182d9fd146d6a4ad9aa96921e
GuLoader
aef1b48a6c4077dd71346018f0fbbf86239a35f34babf980e4469da9ddbf42ac
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
cdfe3c9dc4aa1e9378e37badc6993e814acb1ddccc2920dc7fc4fa226d4058e2
GuLoader
cfc1cfcb5119cb196b34e5905578d55e2afd871f2b93f820637e6386168892c5
GuLoader
+ 867 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ldq1y1hwsn/
Behaviour
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 71a64f7df46db361182074e7f146e186bbc67ffab5b787a3644cb79b77cbe721

GuLoader

Executable exe 26fc46f356639b8fe74cd3df54e1416d07d225950c846bf166f3679152a8e5a0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385254/
  
Dropped by
MD5 9c1c7de792c33af8a5a4add7cf16feee
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/7471/
  
Dropped by
SHA256 71a64f7df46db361182074e7f146e186bbc67ffab5b787a3644cb79b77cbe721

Comments