MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4efb9c06d7fbfe766220885b9f1320589cf9ae96a900a935e2d1ef3cfa971a3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4efb9c06d7fbfe766220885b9f1320589cf9ae96a900a935e2d1ef3cfa971a3d
SHA3-384 hash: 72caa63e314cb2cc22ad3dc9065def518e575fe72fedc67a86ee6afa5b82ceeabaf44d660a30e629cd5ebcc0b28e2f81
SHA1 hash: 8476ff627dce9356c9b78deed7134fcdc4a23270
MD5 hash: 11f1444654d2006cfe377560b5a33d01
humanhash: minnesota-ink-item-oxygen
File name:lab Quote 3000#.pdf.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2020-05-21 10:29:43 UTC
Last seen:2020-05-21 12:24:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f9331725f5241b8d8c1fb97d8e09cec (1 x GuLoader)
ssdeep 1536:VIKolHXEg6qNyqKU6BGnQTBoKmeY6AoKcL:G8g6UMoQxj
Threatray 125 similar samples on MalwareBazaar
TLSH FBA31B207AE0AD31DA6489F18D65976C207FEC753E128E0B65C77B2D2533A81F12539F
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: protekmedical.com
Sending IP: 209.58.149.73
From: AmandaLankford@protekmedical.com
Subject: Confirm Scanned_ purchase PO.45012786018 || Singapore
Attachment: lab Quote 3000.pdf.gz (contains "lab Quote 3000#.pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=19wVtxHamAS-N68Gz1qqOEuW1z9bmt72lZ

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaF.34122.gm0@aKb5uki.10550.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 10:36:55 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j35zybwx7p7hmyrarbnz6ezalcoptluwveaksnpc2hxtz6uxdi6q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
007062a34e83708ffb082b43d65c65bb245a5dfb699bd7d455400c1ecf8ca9fb
GuLoader
270b7f2dfa665133fe2d57069e4654b4065d5d919e4b881ab28ec215273bf767
GuLoader
2c70b55a898ef83a75e8558047851e40d839b5a1c151b967797c3c4d2afd350c
GuLoader
37badb60f9862a09e36f6fbad57f97375fccf52cb00dfd2415e5887031753be1
GuLoader
38b8d9983df22426b89c88131a63c57734d358c79b08ab51feb813f7f980409b
GuLoader
66c4b095722a3fedbc6c0279c57615abc384934fbdf91054d7d382ccd2560890
GuLoader
a604cb5bd365ad6662b63b91c891d9af6c02a4fd89d29d6ad775d9401b31ac14
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
bb199d304cdc30761b11d28c71fec48596ab117ca094f1f5ad6362da890453ad
GuLoader
eedbb575580c9efc8e2a065c6713d388094d08b54d7d4e383ff7ee9446646241
GuLoader
+ 115 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-cxawlqbdn6/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 96e161bfd83d04e546daaa67265a484923cbc70a4d0ce34c9e4ed14ec172f653

GuLoader

Executable exe 4efb9c06d7fbfe766220885b9f1320589cf9ae96a900a935e2d1ef3cfa971a3d

(this sample)

  
Dropped by
MD5 b812cf992e5086729015754e8bc870dc
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 96e161bfd83d04e546daaa67265a484923cbc70a4d0ce34c9e4ed14ec172f653

Comments