MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e6f9c96b9332cdb7bafa068de6591e073bc8255d37f22f08a796f77f9d3d63f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e6f9c96b9332cdb7bafa068de6591e073bc8255d37f22f08a796f77f9d3d63f
SHA3-384 hash: e0a879f295ae6d2ae3eb3939032fdb526d7cbfe045627b6940cb137aae7f4a1a70899ea3d003ce9639ea933c4a1f96a2
SHA1 hash: c8c0f274a76752d2676720b52dd2ad3b13792709
MD5 hash: 78a2177c0352a209b5e4abffc5d7cf23
humanhash: early-summer-iowa-cola
File name:SLD-E2020-0002.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 06:51:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 894021bae3426f6abaf231be95b5e5ce (1 x GuLoader)
ssdeep 768:bicGMjJvbviBcF5gjN7wb9ZPGSN3BEeOAB0WeU+XiIMT69tv:b7G0tqjN0b9kSFOA0WePt
Threatray 792 similar samples on MalwareBazaar
TLSH E4534A0F6D089963E5304BB039B295A56315AC28050ABE4B7E8C7F5CEB715C3BDC332A
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sungwon7.co
Sending IP: 111.90.158.36
From: Giulia <giulia@sungwon7.co>
Subject: please quote it based on attached template
Attachment: SLD-E2020-0002.rar (contains "SLD-E2020-0002.exe")

GuLoader payload URL:
http://111.90.146.31/rfq_LrULI174.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7475/
Detection(s):
Win.Malware.Malwarex-8014471-0
Create hunting rule

Win.Malware.Malwarex-8014474-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Occamy
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 02:58:07 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fzxzzfvzgmwnw65pubun4zmr4bz3zasv2n7sf4ekpfxxp6ot2y7q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
163b0dbdbeb27d581695908c409f25a926613547da8cc08e844e2a93307bd9aa
GuLoader
352837f7f48c65bab461ad1a4b907226f08604cf13390f8e187daf08e0da7aa5
GuLoader
631c795e9e20bfd8d33a2ecc2d8e1e22f925eb2aff8f052904bd779a66ccaada
GuLoader
688ac9fd686d48bc6fec56f27e814c48d7849f548ef14d763dd446b61140c388
GuLoader
8e73f4dbd13dd1cf8475bab8fae351b8a05507e429bd3b3700fca13dc764d66a
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
b32579e01c28fc0a157f14ce8c679d02fcd1f5c03f8eef56ba6a77a627786d84
GuLoader
c940837494435b53d54b6b4349031a14bf5db905a22b7601e34deb851b109715
GuLoader
d7162b14867eff2ee6b1c0506f91c4e8c1a1cea0ddae632bd49156a179549772
GuLoader
f6c4c54e5af63b2b0f393830ddbf2a985289eb9bf6cb8a65ee7d68a79ddeb7f7
GuLoader
+ 782 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-xfkyyxadz6/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 8e7e2b4c3de1897fad0009edfdac94db8910acaddec0138bbacfcd4761927101

GuLoader

Executable exe 2e6f9c96b9332cdb7bafa068de6591e073bc8255d37f22f08a796f77f9d3d63f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385250/
  
Dropped by
MD5 fc6f8e6b90cd3c1f1079e99f5386970c
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 8e7e2b4c3de1897fad0009edfdac94db8910acaddec0138bbacfcd4761927101
Cape
Cape
https://www.capesandbox.com/analysis/7475/

Comments