MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 706d17f8918076d94553487e8a8a51c2145ae4530a4ab9993c3b0e0480edf57c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 706d17f8918076d94553487e8a8a51c2145ae4530a4ab9993c3b0e0480edf57c
SHA3-384 hash: cd54bd7402e53beba704dc260110ac1efb589345bbf8e4cc975efff91496e836518757b330a7466c690b98262f833407
SHA1 hash: 0cc763f0de146d4e253134bc95d3d00bbddac7c3
MD5 hash: 2f18915a978f143398e307c7a25e528d
humanhash: four-princess-network-utah
File name:FA.202005.000638.DOC.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 11:34:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 01b4661cfcc15cfac55f4d035d59ebca (1 x GuLoader)
ssdeep 768:bIwGMjJvbviBAyI/OUaOg289NruLyNDOgbglUaZoCWSMT65Bl:bzG0Lp2U3YO2Odl/
Threatray 799 similar samples on MalwareBazaar
TLSH 3F535C5B39089D53E020C3B02D6295A56728BD689501AF1B3E9C7F5DDF72A827CE331A
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: myuncommon.favour.com127.0.0.1
Sending IP: 2.56.8.246
From: info@gratacos.site
Subject: Pago rechazado
Attachment: FA.202005.000638.DOC.img (contains "FA.202005.000638.DOC.exe")

GuLoader payload URL:
https://onedrive.live.com/Download?cid=3BCD34D8AC2D7789&resid=3BCD34D8AC2D7789%21435&authkey=ADMsJhgPkBTcqZs

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/7523/
Detection(s):
Win.Malware.Malwarex-8014471-0
Create hunting rule

Win.Malware.Malwarex-8014474-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:36:06 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=obwrp6erqb3nsrktjb7ivcsryikfvzctbjfltgj4hmhajahn6v6a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0ad4f6db3a7a39ce0c3df5c2424f572c6a24645cd6c40e4446843dba3e646a12
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
352837f7f48c65bab461ad1a4b907226f08604cf13390f8e187daf08e0da7aa5
GuLoader
743b0bd67e604e9e69acffcc8c7d56d8294de21c11c1a16cbeea94f82b6e5fa4
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
c42ae355f2541ec7be30e51b1fcb50a1c7d8b0d6afa717dab533369cb5a69011
GuLoader
d6bc5d9a16a34c592b8ba23f6a5c3359b06d3d4fdc1215419e1b6e4bd8b6844b
GuLoader
e313f57f18897c99dd4718ff31449333e79281266f068f88aa2957ccfcaab03c
GuLoader
f060225054513f81f7600706174134f5bed19ede10f3134f59514542305c7f2b
GuLoader
fffe29a16f9f4f06318d753e6941bd4bc57f638a8dfd212fd8212d8ee1313647
GuLoader
+ 789 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-8e5r2gslza/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 8597d45b19d0ef100cc0cefd557b1252badf6b1031d071c0b3463592cc902be2

GuLoader

Executable exe 706d17f8918076d94553487e8a8a51c2145ae4530a4ab9993c3b0e0480edf57c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/383111/
  
Dropped by
MD5 a8ee3ff0a8db9fdcb7d715be1cc37ec9
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 8597d45b19d0ef100cc0cefd557b1252badf6b1031d071c0b3463592cc902be2
Cape
Cape
https://www.capesandbox.com/analysis/7523/

Comments