MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 487032be06deec0a6b50c6c0464edb67d50f9bb769ea1527969d4b67b83e8733. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 487032be06deec0a6b50c6c0464edb67d50f9bb769ea1527969d4b67b83e8733 |
|---|---|
| SHA3-384 hash: | 4e24c43fae3096cfccdc562cec605794f3b47354f7aef13826e89e50e663d87f5a8d6cf5bd7bd03cfe30c886aa5f164c |
| SHA1 hash: | b16ec00795848ced90e1e2dcf990fc8fdfc7fa24 |
| MD5 hash: | 5c2f0c7c8f1ac7310cfa9b11f320cc55 |
| humanhash: | mike-michigan-five-beryllium |
| File name: | Hormephobiadesignee.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 184'320 bytes |
| First seen: | 2020-05-28 13:15:48 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7037f6fae6af4feceb3dc3603a782745 (1 x GuLoader) |
| ssdeep | 1536:yRA7ruJTKwcx6NlOAEWi2X5FOgtiBb88Z+zpATDBqwj5PGNdqlZlm8dNp:iA715s73biqm+z+1qMPogR |
| Threatray | 973 similar samples on MalwareBazaar |
| TLSH | CC0439227A55DCB5C66042B4DCE1C4F80535AC18CE178E3B32D17F6FB53B09A9A6A273 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: box.graetfoodgroup.com
Sending IP: 142.11.195.72
From: Salil Johory <dipak@graetfoodgroup.com>
Subject: Re: Wire Transfer Confirmation 100261804
Attachment: Scan0001.pdf.z (contains "Hormephobiadesignee.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1VDDr13QB-SbZaBWx30W2Z7lMfIeRUu_3
Intelligence
File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-28 11:07:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
14 of 30 (46.67%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
remcos
hawkeyekeylogger
emotet
Similar samples:
+ 963 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.