MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4320e2bf2bc6115ae79a52777bdd9aef62db691a756640f9c7fa6e8372e46193. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4320e2bf2bc6115ae79a52777bdd9aef62db691a756640f9c7fa6e8372e46193
SHA3-384 hash: b506cfb7fb72d6817c9a9c4b18e3dec7e2837388862f4c432d8cc56aefc496dacbcffe974463ad4310f38ef64974e0e5
SHA1 hash: afab04ae763768d04d9571b53a988912d36f9501
MD5 hash: f2866779247dba8e3003395b74c0c0c7
humanhash: neptune-minnesota-hydrogen-purple
File name:Quotation list.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 06:49:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4c0adce6308244fbd098252c1f44ea42 (1 x GuLoader)
ssdeep 768:b3nGMjJvbviBbRx+Wg9oxq5YRFE+DO/+OpyC0DOVDkWo+TuWNwT6UKs:bXG0sxJmaCWOJkWovH
Threatray 854 similar samples on MalwareBazaar
TLSH 46535C1F7E08D553E1608BB02E6196A52619AC290501BF6B3E8C7F5CEF31683BDD371A
Reporter abuse_ch
Tags:exe geo GuLoader Outlook THA


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: APC01-PU1-obe.outbound.protection.outlook.com
Sending IP: 40.92.254.28
From: หน่อย วงศ์รัตนโชคชัย <noichuthamas@hotmail.com>
Subject: QUOTATION LIST.
Attachment: Quotation List.lha (contains "Quotation list.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1JGS3tJpF4W4RJEnPGmQp2ufJI6ZRJ9Mh

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Nanocore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7462/
Detection(s):
Win.Malware.Malwarex-8014471-0
Create hunting rule

Win.Malware.Malwarex-8014474-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:51:07 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=imqofpzlyyivvz42kj3xxxm255rnw2i2ovteb6oh7jxig4xemgjq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
150399bdd91521ff244c8c83aa0ebede3560304bcd38a0fd21a189fa34b605da
GuLoader
24ebf6b9c1e61b3bdf58d0678683a8cae05860849a4d8b58a089af47a5ef67f7
GuLoader
2d49b1fe3da354221f225b3d9f99647f41c82eb2248acec1d79ddf62422f6f43
GuLoader
3bce2cb71450f3924688d64791d70feaa8a49e25784d3d64451b3b1d2d25cdbf
GuLoader
511e0187a9180a083947a3bb3de77215fd37b0cae921181dee572bf537d2bea9
GuLoader
6535df8dcbd659939c18a93ee2b58e8ef05898e1baa30932cf3cfa876659d183
GuLoader
8d4b6b5a3f228456841a6627f6b4fe4de260e1261e312b30b62120d5297e68c1
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
e265bbf3f727ff892423b3e24b5368ab4f694c86334bf68ae62ff20dfd7ce5b6
GuLoader
e28da88ff0d294d8f4bc7cacae31814a43026ddac38a554ef697e703122e46c5
GuLoader
+ 844 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-pn8wvbr4ej/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar e58e12ddfcc0bf623d05a6e194f268b92dc8580b54c7a53b918c26fec453b28c

GuLoader

Executable exe 4320e2bf2bc6115ae79a52777bdd9aef62db691a756640f9c7fa6e8372e46193

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385263/
  
Dropped by
MD5 b3a146cdb13f34a1671344d316dcbd91
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 e58e12ddfcc0bf623d05a6e194f268b92dc8580b54c7a53b918c26fec453b28c
Cape
Cape
https://www.capesandbox.com/analysis/7462/

Comments