MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 85c90523ee7cf832993784c6a6b0c6aef6f42ed71d670cef3b11e1673708d8a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 85c90523ee7cf832993784c6a6b0c6aef6f42ed71d670cef3b11e1673708d8a3 |
|---|---|
| SHA3-384 hash: | f4285f22286117e323a7375ca656a0f1cf82656d7f5d1e63d5dbf1b2c2589a304bc887ba4790e3e7d02182d71b114630 |
| SHA1 hash: | 98a8f0abe4a43c4f0091103033bd2c8eb8d4d8af |
| MD5 hash: | f41f44473b0b4b1a2eafc989efd33c79 |
| humanhash: | delta-montana-illinois-uranus |
| File name: | New Purchase Order file 93373Img.com |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-04 15:55:50 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4026f729103b812aae1671acd7a78eea (6 x GuLoader) |
| ssdeep | 1536:7oMrgz7zyCsIvGMD1MwgtxJjDinL+ap/AEfgd0VESjPK65V3gedfrOU+EK:trg/GSD1M3unLzId0OSbK65VwedCFEK |
| Threatray | 583 similar samples on MalwareBazaar |
| TLSH | C7937D625BF6AE31EE36CBB107F45154903BA83634CE4D0B15F929386F36A48B4B2753 |
| Reporter |  abuse_ch |
| Tags: | com GuLoader |
abuse_ch
Malspam distributing GuLoader:From: Titus S Kemp <procurement officer@ctc-group.com>
Subject: RE: Urgent Request Quotation CTC Group Global For HTR 864
Attachment: New Purchase Order file 93373.IMG (contains "New Purchase Order file 93373Img.com")
GuLoader payload URL:
https://onedrive.live.com/download?cid=F53D70ACEFBCDE31&resid=F53D70ACEFBCDE31%21106&authkey=AFDBdxoeAHd_RRw
Intelligence
File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-04 15:02:12 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 573 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.