MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b6460bb14fdce88ab8ec80e5cbfecbb15bbc09de1e75c51246d1c670925b340. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b6460bb14fdce88ab8ec80e5cbfecbb15bbc09de1e75c51246d1c670925b340
SHA3-384 hash: 6b109b1c92644e6dc47d250312f786eada03d8b15ac09bb3ce4283cd91258107538e79741486688e9f03204002021581
SHA1 hash: 6838ba74da512c9e2c641228a69179121be6cfac
MD5 hash: bf16df82371aa8e4d18be0c7bd213b0e
humanhash: comet-grey-wisconsin-victor
File name:ORDER_1973.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 06:50:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 369c603d18d8ab1e451afea9b73e678d (1 x GuLoader)
ssdeep 768:binPGMjJvbviBU4ReqDhNqX9cpbdeYbqa9aBJOjd9KmhuqWdNqbMT6IPYbm:bmG094RPD7qXeL6Ox9KmGas
Threatray 968 similar samples on MalwareBazaar
TLSH B7535B5B6D08A593E07187B02A7285E4972A7C2855027F5B2E5C7F1CEF31AC27ED331A
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: yuntong-batt.co
Sending IP: 111.90.141.203
From: Sherly (Import Dept) <sherly.imp@yuntong-batt.co>
Subject: SV: SV: CONFIRM ORDER
Attachment: ORDER_1973.rar (contains "ORDER_1973.exe")

GuLoader payload URL:
http://111.90.146.31/bin_DjHTZkf127.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7468/
Detection(s):
Win.Malware.Malwarex-8014471-0
Create hunting rule

Win.Malware.Malwarex-8014474-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 01:51:48 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hnsgboyu7xhirk4ozahfzp7mxmk3xqe54htvyujenuogocjfwnaa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
00d1510ab154eb7e4b09ee4ac915fab0577c5b516fd99375b19eab8eaebac4ec
GuLoader
0951d8c7c31922177bfac1849388cf7e947d6e51ccbf936c7edd1e6d7c44da9d
GuLoader
15187de4f29194c60f3f199549c345592e967ee8ecf9a39b0a40c1796fdb222c
GuLoader
2cf01afb98a61b2af1b0458770d83d230d1c9ab3bfcb9f2b6a504395403b5165
GuLoader
688ac9fd686d48bc6fec56f27e814c48d7849f548ef14d763dd446b61140c388
GuLoader
96ffe97ffd555e8f1329ba24b40cba5320d5bc1ef51fb0155b9dea55bf842487
GuLoader
994655b2cfd0979f7b96ae1f4423510633a82adf92fa6486dfd2f3243e96618d
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
ccfc389f6dd3e6d9974b6cd4bb2a2efa5eb060f48e784aabd21a723cb58ff063
GuLoader
f8bafa64755f10484342423a2069ab6f9f817065b1f6bd45db2032677c64b7ad
GuLoader
+ 958 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-btg7grs766/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 02965b722bb14b76f13f6bd70ee833a2a2eb89bed3c62eccce833a33c233f4a6

GuLoader

Executable exe 3b6460bb14fdce88ab8ec80e5cbfecbb15bbc09de1e75c51246d1c670925b340

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385255/
  
Dropped by
MD5 2a68837968c7084c1882a5c52817d35f
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/7468/
  
Dropped by
SHA256 02965b722bb14b76f13f6bd70ee833a2a2eb89bed3c62eccce833a33c233f4a6

Comments