MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4bed372d49cbb980146b1900cf0e641d7e5e9a72a25afbeea28ff996cb93da5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 4bed372d49cbb980146b1900cf0e641d7e5e9a72a25afbeea28ff996cb93da5a |
|---|---|
| SHA3-384 hash: | b328bd2670e5a38348d02417bfc277915bf1c24ec7f7a76562a9aa92a44b3343ef18c304125bc998b6bcb9ac9691302f |
| SHA1 hash: | d307ed6f773f4998259111c98d6af9d6f4833bd1 |
| MD5 hash: | 8a3c722ff3b20e1138da11dbfaee89c0 |
| humanhash: | april-thirteen-charlie-nevada |
| File name: | quotation.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 77'824 bytes |
| First seen: | 2020-06-08 12:14:06 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 033b8b0b9fc3d062c1b7fb3adc96588c (2 x GuLoader) |
| ssdeep | 768:EoSysfNpuRnnPilTjATMM0NevgEcaIcoiupTkRXQJtEWx4Be3KOA9Yz3gAYhhPuL:EoSysFY6TjMl09oAp0goKKDM0g/x |
| Threatray | 1'223 similar samples on MalwareBazaar |
| TLSH | 3673A013AC00C581F0E186B1ED938E9967762D29AD435E47364A3FAFBC317C65EE122D |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: dd42314.kasserver.com
Sending IP: 85.13.157.240
From: balasus@aachtal-apotheke.de
Subject: Re: quotation/INV655
Attachment: quotation.zip (contains "quotation.exe")
GuLoader payload URL:
http://156.96.118.179/AWELE-RAW_GTWfCx233.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-08 12:16:05 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
azorult
guloader
Similar samples:
+ 1'213 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.