MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 396c661ffc736d98af8dfbb324b5a67ec3feb379579969b22b6ffc61d60e4ef4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | 396c661ffc736d98af8dfbb324b5a67ec3feb379579969b22b6ffc61d60e4ef4 |
|---|---|
| SHA3-384 hash: | 6213dc727d8935ee335ae0a733b0aade0f352a07a92c62932cdbc48fb2b1001df3b20230e54eaee61fad5a476afb002d |
| SHA1 hash: | d00ccfc888d8e82398774ef9e06d2bef8efaf331 |
| MD5 hash: | 688be9cca636a340030c709cbd010617 |
| humanhash: | green-cat-twelve-robin |
| File name: | e-dekont.pdf.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 184'320 bytes |
| First seen: | 2020-05-28 13:17:35 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0096b679207529de901d51b75843faeb (1 x GuLoader) |
| ssdeep | 1536:S9oplOCQoxcYrhzuCcXqhbbUWfiS3z6cXG6/8/yfvyNG3FyFYe7C5QyO8Sp:YopQCVrhzunahnqS3z6M8/lNYd8 |
| Threatray | 232 similar samples on MalwareBazaar |
| TLSH | 2C0428323656DC66CA6446F4DCE2C4F40521BC1CCA1B8A27B3D07F6E36BA58B9D26371 |
| Reporter |  abuse_ch |
| Tags: | exe geo GuLoader TUR ZiraatBank |
abuse_ch
Malspam distributing GuLoader:HELO: max0.noekin.net
Sending IP: 213.59.119.242
From: ZIRAAT BANKASI <ziraat@ileti.ziraatbank.com.tr>
Subject: e-dekont
Attachment: e-dekont.pdf.img (contains "e-dekont.pdf.exe")
GuLoader payload URL:
http://185.205.209.166/wext/net-N_oCAkzZdgp45.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-28 13:37:35 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
7 of 31 (22.58%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 222 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.