MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 869df63edd9b9c96960da5d8022b1194c9f16b4a1f0b9ebfc7860e1aa2fe41a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 869df63edd9b9c96960da5d8022b1194c9f16b4a1f0b9ebfc7860e1aa2fe41a2
SHA3-384 hash: cd813ec8f8506d3dba13fbfacd851a1e17117085c55cae219f424af485d1bb19c7c8e7bc1f699d3be836d997be1529d0
SHA1 hash: dde101fa9e4ee74e72921eaa74954949319ba7a4
MD5 hash: 95b086a0dc58ff4e6d9d5ef8b7c494ce
humanhash: november-florida-connecticut-vegan
File name:INV6565.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'016 bytes
First seen:2020-06-08 14:48:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 99c7b4897922c43212a96cea8c3b5f81 (1 x GuLoader)
ssdeep 1536:nKuRtSwhXyRV5oR1ZriaHUayXQssdWhddu/dH1ogg/x:TzcjoRIqs/x
Threatray 747 similar samples on MalwareBazaar
TLSH 79838D177A5CC101E1500AF4ECF38E602A77BD161CC2AE6F114ABF4FB8757527AA622D
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: dd42314.kasserver.com
Sending IP: 85.13.157.240
From: ruediger@aachtal-apotheke.de
Subject: Re: New order 892
Attachment: INV6565.zip (contains "INV6565.exe")

GuLoader payload URL:
http://156.96.118.179/AWELE-RAW_GTWfCx233.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7055/
Detection(s):
Win.Malware.Agent-8012294-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 13:54:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q2o7mpw5toojnfqnuxmaekyrste7c22kd4fz5p6hqyhbvix6igra._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0c69b80c225b95161ab357d6a35bf54846167a38bea69de84371c283ffcd0a8c
GuLoader
494d5e5f87c9552bce9a4c255ab358cabb144982fca06703255e0ec791626865
GuLoader
7dc9d4200ada4d75e50d7c4ed86eef952334e4bb69da0464122682e7aff8d971
GuLoader
88dfd10d3d3b459c8284f0c64b88786c5770eb2b75436be9951ad1117c1b6a0f
GuLoader
996d663495ef1d96ee9fca68c07a4173910824b4956214edd0af1c53501608d7
GuLoader
b189f4b81e32c2be2c252d6f6ba160bf8566aa74be9642af4af5e3b424be54ca
GuLoader
de5da2008e231c60a227d6700248953651e0242542f07027e400760283b91d42
GuLoader
fa8949da882bd317bc4b975dac2514553258a79a3ec0e7bb2e029f61e131ed66
GuLoader
fc69637262c3ccd722552ece430c078195f3999934cccabdb2fcf0a6e2fe9446
GuLoader
fde85b3d5e4784dcef4c245c1db1ee0bb5d496fe4de8548594f569964715d515
GuLoader
+ 737 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-rm1yke4yxx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip cc5cfa5f5592c9439c03289a58c9ec22d6318f68ca9af6db5210762d396d0aea

GuLoader

Executable exe 869df63edd9b9c96960da5d8022b1194c9f16b4a1f0b9ebfc7860e1aa2fe41a2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/369174/
  
Dropped by
MD5 7faa584e478e8fe6c6bf4a117688121a
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 cc5cfa5f5592c9439c03289a58c9ec22d6318f68ca9af6db5210762d396d0aea
Cape
Cape
https://www.capesandbox.com/analysis/7055/

Comments