MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b8f8c5da5f2aa72adb56a42195330329e279ffbc1958fd568008fc8e5916b70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b8f8c5da5f2aa72adb56a42195330329e279ffbc1958fd568008fc8e5916b70
SHA3-384 hash: d865508a7e3264842c07f7a634019703285a851f19c0bb4b585c0205014b65f16b00882d681a34c2099b1736021045c5
SHA1 hash: 75f6f716857e020069b33d209b1a00da3f6aa5cc
MD5 hash: 90893d36822ef4363a2b2221d2754d7d
humanhash: vegan-leopard-stairway-equal
File name:RFQ.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:57'344 bytes
First seen:2020-08-19 13:35:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 43e265321ad032f6aa7158f8fa8b91a4 (1 x GuLoader)
ssdeep 768:wsGjyAXl109kJwfzwk4hfvxCvISXeMC6PBTI:wHj109gP1CQSXeMLBc
TLSH 1343B3297E7C3F6FE3F94630195646B516A5ACF4CA06CFC2E604367E0870E01A85F792
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sh37.ich-7.com
Sending IP: 184.154.80.146
From: bosung <masiur@infancyit.com>
Subject: Purchase Order SK-20071405 From BOSUNG Eng.
Attachment: Purchase Order SK-20071405 From BOSUNG.IMG (contains "RFQ.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=138UKyynMrtGy6YdSISWRI9JqEDfvZvCA

Intelligence

File Origin
# of uploads :
1
# of downloads :
258
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/48565/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/438226
Signature
Potential malicious icon found
Tries to detect virtualization through RDTSC time measurements
Yara detected GuLoader
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b8f8c5da5f2aa72adb56a42195330329e279ffbc1958fd568008fc8e5916b70/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 04:11:36 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hohyyxnf6kvhflnvnjbbsuzqgkpcph73ygky7vliach4rzmrnnya._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200819-vdw8gnm22j/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b8f8c5da5f2aa72adb56a42195330329e279ffbc1958fd568008fc8e5916b70

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 8cc7d032661b2c76ac519838568e7d5642c95a400244ec4c297fb9b7c051884b

GuLoader

Executable exe 3b8f8c5da5f2aa72adb56a42195330329e279ffbc1958fd568008fc8e5916b70

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/436361/
  
Dropped by
MD5 ce8b1b7267876480a54eca2aedf2abb2
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/48565/
  
Dropped by
SHA256 8cc7d032661b2c76ac519838568e7d5642c95a400244ec4c297fb9b7c051884b

Comments