MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5c28300cdf3427d16bba325ac19073a5ea652183b8ee79cdc979dbcd9727bb27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 5c28300cdf3427d16bba325ac19073a5ea652183b8ee79cdc979dbcd9727bb27 |
|---|---|
| SHA3-384 hash: | fbc3052197d516bc8b89f61635b98f2c52124286342fcc91fe4a29d8a2830696cd9a7acce31a18966c9add13ce64337f |
| SHA1 hash: | 03cf58e8d592fb7d6cc3c07e9db098773b0d47ad |
| MD5 hash: | daa01f5e9a9fb6cb70ad27548d6c4efd |
| humanhash: | golf-emma-south-mike |
| File name: | ORDER & INVOICE.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 77'824 bytes |
| First seen: | 2020-06-01 08:26:52 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 38360fb1efbff1c1791f912e4f62c1c7 (1 x GuLoader) |
| ssdeep | 768:O30XukeJBpKcUnL6VSMyGz887io1XnLkdnFlSTavfEy/ksnUzLLVzo1:O30+kCknL6VJPf1XwwTSksnoLK1 |
| Threatray | 750 similar samples on MalwareBazaar |
| TLSH | 2D73191EFF5D8164F4054AB11955E066BB29BC3258065E0F73006EAAEC72A87FCF172B |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:From: "Sales Engineer" <user@t-online.de>
Subject: Re:picture of goods we will like to order from you.
Attachment: ORDER INVOICE.rar (contains "ORDER & INVOICE.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1ruj4EfLfnmtjm6oXOGEowWHp-7QWPElt
Intelligence
File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Razy
Status:
Malicious
First seen:
2020-05-31 20:57:38 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 740 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.