MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 575397578fec6865ac95bcf6541e56a711bcfe08e3bb0d9bb456ff345ab1602c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | 575397578fec6865ac95bcf6541e56a711bcfe08e3bb0d9bb456ff345ab1602c |
|---|---|
| SHA3-384 hash: | 63142fee6da5b3ac316435813b4b711223b82f888933805b428b58ba4f5335aa765922a3d6d840c620722f7852b76935 |
| SHA1 hash: | b69c013f48dae5f512afc91196583762e68c30d3 |
| MD5 hash: | 7116e00c981ca925a72e3a25a35d8e10 |
| humanhash: | oxygen-six-muppet-missouri |
| File name: | Quotation.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 110'592 bytes |
| First seen: | 2020-05-26 07:26:05 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e2a8ab57ff6f1675929d0d20e907d379 (1 x GuLoader) |
| ssdeep | 768:twQ+Gj6XPcM1ik/QLD+7yl/NbvqE6xG/338HrRrVH8utrq2tS7QHUw45A7cZqZ4N:OYIKRbqtrjte2o7zNdkTmA2UM |
| Threatray | 1'626 similar samples on MalwareBazaar |
| TLSH | 91B3E61376C4ACE6DE204FF188B99AB80D6BBDB908404F07391EFB0F25777845BA1659 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: uppercrustjakarta.com
Sending IP: 37.49.230.164
From: Mary A. Wiley <mary.a.wiley@uppercrustjakarta.com>
Reply-To: yingzhang67@yahoo.com
Subject: Revision of Quotation
Attachment: Quotation.zip (contains "Quotation.exe")
GuLoader payload URL:
https://hosseinsoltani.ir/wp-includes/fonts/hilari_arJEkUQZTs93.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-05-25 14:11:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 31 (64.52%)
Threat level:
2/5
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 1'616 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.