MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 71042d1c33cb49ff3cfe79416497b82b9f58a7e3179da4a1e5ce0e9a55342935. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 71042d1c33cb49ff3cfe79416497b82b9f58a7e3179da4a1e5ce0e9a55342935 |
|---|---|
| SHA3-384 hash: | 340cf9481ef66b7e65701fe60436ccabdf52eb294763351577d2083b8b3d14af9a90788a064ece3ea92eb3d563bfc903 |
| SHA1 hash: | 6e3d8e9ab4a991a1f636ff069eb08546f8dbee60 |
| MD5 hash: | 50aef47b4ff7ce07ee964bc924b0efd2 |
| humanhash: | artist-nevada-aspen-seven |
| File name: | XINYI ENERGY P2.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 73'728 bytes |
| First seen: | 2020-06-10 17:29:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ba2c72414ab581e87dcee5c5d5a299bc (1 x GuLoader) |
| ssdeep | 1536:bpB94d4xRc56tvVK4kwJ7rbbwBuGvuukaotY4Iygw:14d75cK4bXbNflayg |
| Threatray | 915 similar samples on MalwareBazaar |
| TLSH | 88736B1FF708E593E130463115B2859057133E1B690FAD0BAE483AAD5673A07AAF763F |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:From: XINYI ENERGY <info@huttextechnologies.solutions>
Subject: RE:Subject:XINYI ENERGY New Enquire+S-2078603 and Acessories
Attachment: XINYI ENERGY P2.arj (contains "XINYI ENERGY P2.exe")
GuLoader payload URL:
https://onedrive.live.com/download?cid=2C38C37ED8430789&resid=2C38C37ED8430789%21115&authkey=AGLzNnSx71tBe9E
Intelligence
File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-10 17:30:16 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 905 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.