MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 33b22f183b47d03a90eab7eda3ecc8f05c5e5b6e011588998d1b9aae4ead0f36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 33b22f183b47d03a90eab7eda3ecc8f05c5e5b6e011588998d1b9aae4ead0f36 |
|---|---|
| SHA3-384 hash: | 906db8146673c8222e201f53408eb3730d56b52d8321fd3528980a1264e6e41d6fec81c8df6c6e5b171187c32d8a5ddd |
| SHA1 hash: | 236ce32a82ca4621439a21624732744772a82b72 |
| MD5 hash: | dfe34d84a84eff1c4ee158871025de3b |
| humanhash: | cardinal-grey-delta-leopard |
| File name: | NIDEX LTD QUOTATION_2020.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 57'344 bytes |
| First seen: | 2020-06-08 12:10:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ed57d38212442c6fbd5a6c2cae3bca29 (3 x GuLoader) |
| ssdeep | 768:gM08jpQCUHsQa1Hc78h1WvxkiPRNXPqcZ+PRlKzWs:c8jpQCewc78evxZH+PRlkl |
| Threatray | 767 similar samples on MalwareBazaar |
| TLSH | 5743E71775EA5011F2024AF3FC619EED1D66FC21C441BF0A66C4FA7B1F31A06ACA562E |
| Reporter |  abuse_ch |
| Tags: | BGR exe geo GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: clean108.mxserver.ro
Sending IP: 89.46.7.164
From: NIDEX LTD <store@nidex.net>
Subject: Необходима е спешна оферта
Attachment: NIDEX LTD QUOTATION_2020.gz (contains "NIDEX LTD QUOTATION_2020.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1dh61IWa7fEtgrnP8A53Q04fHssd8qOWY
Intelligence
File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Lokibot
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-08 12:12:05 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 757 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.