MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c567d47335c4c7a99133643e137e824203b8958b44e1c8a0aaef7a6aed39cf1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c567d47335c4c7a99133643e137e824203b8958b44e1c8a0aaef7a6aed39cf1
SHA3-384 hash: 54c14135ec4e1931220463d62f546e040ac176ec4c15271119c89db48e16e54502ae602f9f0f9f155360cc39c66cac1e
SHA1 hash: 603b69688a41bb7e1491376b17a06455e975c8a5
MD5 hash: 63421cbd65318fd16cebe28f84332ff7
humanhash: lima-uncle-oranges-uncle
File name:New Order PO2833620 From Metric Group.PDF.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:126'976 bytes
First seen:2020-05-08 12:53:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ffdfdf7396e385215bf14094fb09557 (1 x GuLoader)
ssdeep 1536:ilmYE3192JRRL8kdIlTQK/7skuMEenRK6Yten/kO4X4ZKRnMkz:vDqtXKQO7skJ9RpnMOFKRf
Threatray 53 similar samples on MalwareBazaar
TLSH F4C3618573C0F667D5E80EF2971A43D525F8AC39AD856B077BC8B11B6639E01EA20373
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: host.sarmcol.com
Sending IP: 199.217.117.157
From: order@metricgroup.co.za
Subject: New Order PO/28336/20 From Metric Group
Attachment: New Order PO2833620 From Metric Group.PDF.gz (contains "New Order PO2833620 From Metric Group.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 13:13:50 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jrlh2rztlrghvgitgzb6cn7ieqqdxckywrhbzcqkv332nlwtttyq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
042359241a3a3f4d635527751c2268cc80121586dc68c9a6732edb20d25ce760
GuLoader
1240a7ff417004b8b3b98ce0d7adc1f959178e730590b45b2cba92c473fc0b89
GuLoader
2eafd2db3852f320398ef9bbbab1d291e52e75bba78e3fe21c0fbffe385ba865
GuLoader
3bb1bbf49c6e224032025dc7dacb3862e8b16c8b39e5cc19c5aceda4dbc917d9
GuLoader
52f137c22685d15df043daabdb9c823e07ecec4df42bcc2fa2c5bd45913d32ea
GuLoader
677825d1c55ffae0ee20b966bf6e7318fd6e0ccbfa1c65a1c42d19997fcbfc06
GuLoader
85d879be258470ed22d55bb6fda8be5d0b7d480c23d95b252516e85ccad2fec4
GuLoader
9532627f43a3de7b9c4414517f18197a08969adec3c24e1c2f1856e32613d5cd
GuLoader
96568402add3b23971d79fa6730a1bd054509512e1d73cefec74c307aa46d436
GuLoader
e6ff6d164a876c50bfc4a6f7b6397914f9656d0e4aef1ceba65f1e92ed1b6c69
GuLoader
+ 43 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-5cdfnpyql2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

feb42e857f325d2f5efaef9bb65bd7b3

GuLoader

Executable exe 4c567d47335c4c7a99133643e137e824203b8958b44e1c8a0aaef7a6aed39cf1

(this sample)

  
Dropped by
MD5 feb42e857f325d2f5efaef9bb65bd7b3
  
Delivery method
Distributed via e-mail attachment

Comments