MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83e97420dbe39c6e29e2ae3dad80f21afe93d1b6ea88962a89762cd64772db41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83e97420dbe39c6e29e2ae3dad80f21afe93d1b6ea88962a89762cd64772db41
SHA3-384 hash: b1a5e3e17b87a5e6d13331bb60837662dca09c5fe925ce5bb10fde2cfefd384b3a97ee942b3c6dd4620bb01093d818bb
SHA1 hash: 22b939539d18cc82e01b09008cd0b9a38a748b88
MD5 hash: 9e4140dc3bf64e7b02de1bd2149c75d1
humanhash: white-nitrogen-steak-oxygen
File name:Scan 562020 pdf.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-05-06 11:03:13 UTC
Last seen:2020-05-06 13:42:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e89fe7b6acb7c90544ec617af92b6410 (1 x GuLoader)
ssdeep 1536:iZ6Ud1ddZ3lTXEp+NebE097fOOM3TWVUy8bO:ikUD33zcEgpcTgUDa
Threatray 632 similar samples on MalwareBazaar
TLSH 8FB31C946AA0DC13E5597AB2EF84F15DE3A16C3968319A0332C1734A5F359C2EF2172F
Reporter abuse_ch
Tags:exe FormBook GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sumo.com
Sending IP: 94.177.243.179
From: Esteban Forcat - Ferretería La Fragua SA de CV <esteban.forcat@lafragua.com.mx> <allan@colleen.ml>
Subject: Re: Beef and Squid MAX--NGM Order---19MS-407855 Lafruga fishco-gco
Attachment: Scan 562020 pdf.iso (contains "Scan 562020 pdf.exe")

GuLoader distributing FormBook

FormBook payload URL.
http://technotiempo.com/wp-content/themes/twentyfifteen/bin_XNjYuaWEr149.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 10:48:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qpuxiig34oog4kpcvy623ahsdl7jhunw5kejmkujoywnmr3s3naq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
051101f45d03dac4583297cce0d708af562dedfa085b3d9dcfea40be2083e7ab
GuLoader
10e06d6dedcfa52bb09cfb066ed4b5276a6a60ccfc5a6230911ce04b829f381f
GuLoader
14bd280177ece118d671795a8b372a0d7de0f3ad3b842ed35726d9b587cb1608
GuLoader
473f6c38f3047708289a930f291a474052b160a9090bc6c2844f53b6226805ad
GuLoader
4cd26d79cdab1d9f934cdee769ab7f1803735a120d95afb470a2466a088c4d5c
GuLoader
b65a42512465c82d804bdb56b5e1e633afa4571a20dc68d311ecad4a8fc3654d
GuLoader
c410f181985c48a013609ed25c046f7e87782ee807e2b8bd0199788a461eec90
GuLoader
df34eee3a23ae66bb689bc1911e417cdaa7b51c353dc586bdb3280f86df09b55
GuLoader
eaf38de6ac4347ac84bcbe648301fedfe021aeafbc3bf40404a4003117a8967a
GuLoader
ff350e4c35228fa75a4d170ed64610f657da14ef47d51c6417af50e861d06e34
GuLoader
+ 622 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
persistence family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-bm68la4y16/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent state file
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.mafov.com/xs1/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 4f0f09e0f2c73bfad2080a2e71c15777f002af3dd16643f041b050875afcfbb9

GuLoader

Executable exe 83e97420dbe39c6e29e2ae3dad80f21afe93d1b6ea88962a89762cd64772db41

(this sample)

  
Dropped by
MD5 0283ac3a7ab3af5b000ebdfbf8176778
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4f0f09e0f2c73bfad2080a2e71c15777f002af3dd16643f041b050875afcfbb9

Comments