MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5f71fa1115c8ddafbe4215ab9b5a69966385bf38bbf033c9c06d6dbaa15abb41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 5f71fa1115c8ddafbe4215ab9b5a69966385bf38bbf033c9c06d6dbaa15abb41 |
|---|---|
| SHA3-384 hash: | 9b734c115c706255dd1ee4ec8d03a5639e917da5f0dae7daa60f9af93403412f4a207402d81a7478bd69dbc9a4f4987c |
| SHA1 hash: | 6184598ebf3555d9cfbe4f8e8bf9312eaf01ad11 |
| MD5 hash: | eaa84e6995f65e6a783d47b4153cad3d |
| humanhash: | jig-london-spaghetti-lithium |
| File name: | Draft_B096122_images.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 65'536 bytes |
| First seen: | 2020-06-10 12:34:40 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 696e9207c0e6f83109a9bef2b150c5d2 (1 x GuLoader) |
| ssdeep | 768:b1cyEfq4d4DdewANR/TqWLc7RX91X+0bb/HtBOvWN6CMxPiDvj0Ytf:bZ94d4xRSLq7rbFBlMxPikG |
| Threatray | 21 similar samples on MalwareBazaar |
| TLSH | 73536D0B7E0DD153E02987B01872A9A51B66BD1C4A01AE173F9C7F7ED632192BDE321D |
| Reporter |  abuse_ch |
| Tags: | exe geo GuLoader KOR |
abuse_ch
Malspam distributing GuLoader:HELO: 061001.novalocal
Sending IP: 45.147.162.21
From: Jason Bourne <admin@moenepa.tk>
Subject: 回复: 回复: New Order for CAMC 6x4 tractor parts
Attachment: Draft_B096122_images.rar (contains "Draft_B096122_images.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1fJIgOWmXE6M1Uys_fzsb1JFobWD7UCi8
Intelligence
File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-10 12:36:05 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 11 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.