MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c0873396c5b24ea79127c4e21c6ff34ff581d96d09142c47efaf7ae0c7a8c43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c0873396c5b24ea79127c4e21c6ff34ff581d96d09142c47efaf7ae0c7a8c43
SHA3-384 hash: 0f823177e61f755edb03e8adc9e82c2aa8e87fd08d3f0a50c590723cf2c8a1858674f7a03ea0e8a4bb1b8c1d18c7e18d
SHA1 hash: fce9085fceb1a90917f562e346d7b353588bdc07
MD5 hash: 098fe3aa5968a3f69d3052ac8406e52d
humanhash: winter-lake-venus-indigo
File name:_Maersk Line Tracking Info.PDF.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-07 04:44:49 UTC
Last seen:2020-05-07 05:54:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fa3f368262cbced929f774c0b17cd605 (1 x GuLoader)
ssdeep 768:waFTnllWWOx7nXESinX3vmifRAU19F6mGUdaL+UnYZO7gY:znllvOx7xOnvmif9vFnVbUhj
Threatray 626 similar samples on MalwareBazaar
TLSH BA93B412AEB0EE26D11476B4EB66F6AEC351EC301A314D0765C43B1E5F39E12AD3126F
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FTA098FE3AA5968.23435.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 05:36:02 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jqehgolmlmsou6isprhcdrx7gt7vqhmw2ciufrd67l324dd2rrbq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10e06d6dedcfa52bb09cfb066ed4b5276a6a60ccfc5a6230911ce04b829f381f
GuLoader
1e04c1e4eefe23f454553364e757209462f2561d8455628b296b1dbe83fc6ec2
GuLoader
47296594a8ffd81843b838555873c6c129bfccd6c211c4033de7cf7523190bd0
GuLoader
623d2dced40110b216c19c5d48ecb250235278055ca3a7192ac98a8640d663f2
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
b32598815ea88a25f6459ae8b5035d0ed9c787d8fee5f124a24543c0550d9070
GuLoader
b4cb5e02fc90c85a8ec05d9216df64e392f416f6d6fc41366608920c9cbf2466
GuLoader
c8b706bb1149005a7e27ee5f954ef9fc057d3d92197079dd3436c507dca3947b
GuLoader
e80e2cf38bd72bd64cafaaaa0eafc2965bdda90feeb5c153947f81dcdb98e6d0
GuLoader
f3b9c07ea611e968e7483b8828a480ff7b356a43eab344c984b37930c8dd6417
GuLoader
+ 616 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-wzrsckar82/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 4c0873396c5b24ea79127c4e21c6ff34ff581d96d09142c47efaf7ae0c7a8c43

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments