MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 58f46319accff094228d3cf5be19cb06ecf1fc4325340a5f0a1c3c69fad53642. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 58f46319accff094228d3cf5be19cb06ecf1fc4325340a5f0a1c3c69fad53642 |
|---|---|
| SHA3-384 hash: | 978d5a77526da210bcdaa7d2b2ab6e5e80f02e7c941d84404324487a4d15b9d0b0e960caa4d1079001b93947655d4426 |
| SHA1 hash: | 94d76d83816e158adeb1eb37a7d6e83d069c1e4d |
| MD5 hash: | 2545dd071e29ceb9aaabe900d7311624 |
| humanhash: | speaker-aspen-undress-blue |
| File name: | shipping documents.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-02 16:01:38 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4912e11c52bc5dc99dfccd637da2e2d4 (1 x GuLoader) |
| ssdeep | 1536:3FO8lLG8Gha+X0t2Bbw5/86LzwKQwrXuTnCCS5cgk:qh30t2xi8MzwPUFk |
| Threatray | 998 similar samples on MalwareBazaar |
| TLSH | 029307436BD85911F1B24A706EBB93996F15BC2A4D429A0F340D5E4B7B307629CAC32F |
| Reporter |  abuse_ch |
| Tags: | DHL exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: 162-241-235-200.unifiedlayer.com
Sending IP: 162.241.235.200
From: DHL Express <support@dhl.com>
Subject: Fwd: DHL Shipment Notification : 7348255143
Attachment: shipping documents.zip (contains "shipping documents.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=10qkByuKJTKPBBfrfbhda8Oq4K-U1IQr
Intelligence
File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Razy
Status:
Malicious
First seen:
2020-06-02 16:35:58 UTC
AV detection:
19 of 30 (63.33%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 988 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.