MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7c35438a1fe6165f0a3fe818dbfc1b65fccb7b534b9a2c085b1527a47237eb69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | 7c35438a1fe6165f0a3fe818dbfc1b65fccb7b534b9a2c085b1527a47237eb69 |
|---|---|
| SHA3-384 hash: | cc6f35bd8fead37da2c39a29daca7316609230efd858ecb14432922c4d78f874bdc75315cec4d44e9861e2b26747f1d5 |
| SHA1 hash: | 5c8493b73b78abf4ed0fef44d1cb6bbb5d5f4ad9 |
| MD5 hash: | 45de0a88f1fdb9ec5b53af51b4f613b7 |
| humanhash: | december-nineteen-vegan-artist |
| File name: | quotation #QTN-20-971-JA04Q7..exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 90'112 bytes |
| First seen: | 2020-05-22 06:38:47 UTC |
| Last seen: | 2020-05-22 08:03:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e46bceeb8eb7fe97702f9dab616d0740 (1 x GuLoader) |
| ssdeep | 768:9RQtyFEwc5L5VOIEYa/TcPSRFr1qEtXr4/33zjpTlirLImJAFHH5kwQWeT:3vFEzVOIi/mSRRJ4/HfpTlisawg |
| Threatray | 104 similar samples on MalwareBazaar |
| TLSH | D5933A21B794EC92DD448DF1AD278AD8116BFC353A054E4734D33EAD3A33D426A7938A |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: lamarchemfg.com
Sending IP: 37.49.230.146
From: sales@lamarchemfg.com
Subject: Urgent Request for quotation DTDC EXPRESS LTD.
Attachment: quotation QTN-20-971-JA04Q7_PDF.ace (contains "quotation #QTN-20-971-JA04Q7..exe")
GuLoader payload URL:
https://hosseinsoltani.ir/chuks%20po_nLatVelbs7.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-22 00:05:08 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 94 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.