MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4675be33b1b3f4b1a348a86088a709b907841e6a6daaa37793c0ed994d40f5ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: 4675be33b1b3f4b1a348a86088a709b907841e6a6daaa37793c0ed994d40f5ae
SHA1 hash: bf7144b6760437fff84601369a5a94808db860e9
MD5 hash: 6e274d54ed055703c06dd45dcffcac82
File name:HT_20200522.exe
Download: download sample
Signature GuLoader
File size:90'112 bytes
First seen:2020-05-22 09:50:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b0da6c1de945a710ef5ef13e4b8e91c
ssdeep 768:tHO0KF/W/8T7b3Zv7h1FC0SRoInjplerAoOYp:ATNR3Zv7hrC0+oIjplev
TLSH 2B933921B298ED65DD818DB2CD665AC501FF7C211C094F0FB6863B2D3937A82792C37A
Reporter @abuse_ch
Tags:exe geo GuLoader KOR

Malspam distributing GuLoader:

Sending IP:
From: 이한석 <>
Subject: 긴급 견적의뢰
Attachment: HT_20200522.IMG (contains "HT_20200522.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 21
Origin country FR FR
ClamAV Win.Dropper.Vebzenpak-7866175-0
VirusTotal:Virustotal results 15.07%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 4675be33b1b3f4b1a348a86088a709b907841e6a6daaa37793c0ed994d40f5ae

(this sample)

Delivery method
Distributed via e-mail attachment