MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c4e8ce35d87b95b71843c0998da344746ce0194aa9a3aefad595eb59708d75f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c4e8ce35d87b95b71843c0998da344746ce0194aa9a3aefad595eb59708d75f
SHA3-384 hash: 513543ba46eb5c96d2e82340e73cb9320870f94d88310113a6c1b16a2ff2a67a014477791093f2deed8ab54f37573903
SHA1 hash: a75b5e370aa66c7f5dc332a0bf0cd5d0f65241b1
MD5 hash: 4ddc64df2203fe9b65cab5050f7d27c9
humanhash: muppet-washington-wisconsin-arizona
File name:Invoice.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 06:51:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 666cd9b34ddb1e05af70e6f1fb5dc2e0 (2 x GuLoader)
ssdeep 768:beGMjJvbviBCNaZN+151sJbQy+Vw6xIu2G0zOlPKR4HmysLb2B+:beG0ByEvSbwxUO9I72
Threatray 877 similar samples on MalwareBazaar
TLSH AA533A4B6D0CD963E12443B03A62C2E5A719BD285505BE4B3E9CAF5CEB352827DD331B
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: host130.cityonlinebd.net
Sending IP: 113.212.108.130
From: Fadi Tahboub <fadi.tahboub@mst-dealer.com>
Reply-To: sales04person@yandex.com
Subject: Re: Shipment
Attachment: Invoice.r15 (contains "Invoice.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1dkHPX9jRoX1-NYrdSgqyjYEkTF58oqFX

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7476/
Detection(s):
Win.Malware.Malwarex-8014471-0
Create hunting rule

Win.Malware.Malwarex-8014474-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 01:33:38 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rrhizy25q64vw4mehqezrwrui5dm4amuvkndv35nlfpllfyi25pq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0ad4f6db3a7a39ce0c3df5c2424f572c6a24645cd6c40e4446843dba3e646a12
GuLoader
3e3529db8cde73fcdb792f6414ebe6fb9a6ec5ba5cf5f503376a795387b2020e
GuLoader
6535df8dcbd659939c18a93ee2b58e8ef05898e1baa30932cf3cfa876659d183
GuLoader
6715e87f7070a2d7b5b2c71e98a7bade689a504aed3b95654af3494248a501d4
GuLoader
7f950bc31a7a30c03b8e703b1f59673a787674452e9c258e8343f9504486a559
GuLoader
9dad25bb4c66c85c54da83d5c2ed752ed7c3452863fc4b46bda7cf440fef509b
GuLoader
aec92581e48c5a9f8e8b920d595ecab2a0af7c81bc49e5d2d3d4bb9c317f1999
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
e265bbf3f727ff892423b3e24b5368ab4f694c86334bf68ae62ff20dfd7ce5b6
GuLoader
f0904d56b0d621156adf1d4449d1b445e6d45eec9c0a4b09e22f9bb95a185955
GuLoader
+ 867 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-hr33vr3vc2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar ff015e299500e8d9d07ae57e6e0e33ec9ee9a0dba566008d57dd241b990908d3

GuLoader

Executable exe 8c4e8ce35d87b95b71843c0998da344746ce0194aa9a3aefad595eb59708d75f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385249/
  
Dropped by
MD5 5b46c768825999601dd0462f15d6ce36
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 ff015e299500e8d9d07ae57e6e0e33ec9ee9a0dba566008d57dd241b990908d3
Cape
Cape
https://www.capesandbox.com/analysis/7476/

Comments