MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3142e31329c54946869e2c0595bf23492f58f776ab9d6123bf20d10b6cba5602. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3142e31329c54946869e2c0595bf23492f58f776ab9d6123bf20d10b6cba5602
SHA3-384 hash: 5c9f8dba09f3fa9b1364e956eb3ce825354165c9a931da84bc1be96bbc750ae15779e48a42a09861b862e2ca14865fee
SHA1 hash: ec75df2eaf7d0b818b71f1177d8c1cf59ae10ba4
MD5 hash: b7c0739e79bcb669a15ebe70369fde04
humanhash: hydrogen-kilo-mango-sink
File name:E62-20200605-BMW-V05 V08.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:81'920 bytes
First seen:2020-06-05 13:36:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2406589a1c6bb99f7a990ccd1e1de7d4 (2 x GuLoader)
ssdeep 1536:3FjDrdLtwiusqiRBFwDwvfKTFlHsOlQTIfLrrZ:3Brdh7bvGEOFlHXz
Threatray 924 similar samples on MalwareBazaar
TLSH D4838E07B90DA653C05446B82E139AA62F2BAC5C4841DE4F3108BF9FFDB57D318D621E
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mailserver2.caotocgroup.com
Sending IP: 128.199.155.118
From: Phạm Thị Minh Hiền - BIOZYM - PUR - HCM [minhhien@biozym.vn] <thanh.duong@dudaco.com>
Subject: RE: RFQ - Order #2020-329487-03 - BIOZYM
Attachment: E62-2020-329487-03-BIOZYM V08.rar (contains "E62-20200605-BMW-V05 V08.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/group/harl_cyMbNbo109.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6682/
Detection(s):
SecuriteInfo.com.Win32.Injector.EMGX.29941.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 01:59:20 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gfbogezjyveunbu6fqczlpzdjexvr53wvoowci57ediqw3f2kyba._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1d4cf3aea3811e50188b9420eae68de18006627f4dd86719459d99ad41d49291
GuLoader
72eb2dc730e3574dcb204d37fcfb35cf91bacd8087d6028d743cb0992c874244
GuLoader
743b0bd67e604e9e69acffcc8c7d56d8294de21c11c1a16cbeea94f82b6e5fa4
GuLoader
761e31eb72cc241c0b5bf6ae44cd9dcc41854f523127a6638ad332ff0b8dfb3a
GuLoader
b1cce5c3801487b851b808c16590f54937f9c36d668b9fcc2146c3d2d2040d97
GuLoader
bff8ed6fb8d736ad790d7306d45715c9a3858a00a6b5be7251d3126020339e54
GuLoader
c3252ba30dcb997aba042c568bee0ccbca5a818248dae999161a5a26ef7f301f
GuLoader
dfe66d2e7938bed4e4452f82519a8b02d0ac89e74341a4abee8b2ec1c6a7ffb6
GuLoader
e0a55cba6885e046f0eb064179877af39b10f3d8cc74b8c697ea7c8cda6ab739
GuLoader
fdb10ff1d5b312ddcad914cf17cfc504da6d9fe264b603c5e83df4fff7da60a1
GuLoader
+ 914 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ecfek4zvk2/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

cf5f15d6faeb91df707ce1ac73645c96

GuLoader

Executable exe 3142e31329c54946869e2c0595bf23492f58f776ab9d6123bf20d10b6cba5602

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/374155/
  
Dropped by
MD5 cf5f15d6faeb91df707ce1ac73645c96
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/6682/

Comments