MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8e8ca471a9f9af066d0c6bc50224b2a42047babcf74fefa7a2746e2177148743. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 8e8ca471a9f9af066d0c6bc50224b2a42047babcf74fefa7a2746e2177148743 |
|---|---|
| SHA3-384 hash: | 9e17eeaa8bc83cc50e0be4bc6cc7cfef17ace2d761f6f3a09579797f621e9989fda794622656a2b45fb399cdc4a8af3b |
| SHA1 hash: | 8892f476c204953b99c35205e991d853b3e3a8a5 |
| MD5 hash: | 975ab01b69d8249d49738834aaf68fed |
| humanhash: | cup-zulu-monkey-emma |
| File name: | Facturas Pagadas al Vencimiento.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 65'536 bytes |
| First seen: | 2020-06-10 12:33:16 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 98c7609c30c3a09278c27ccd8333670c (1 x GuLoader) |
| ssdeep | 1536:bF94d4xRDgAW4hY5Y6ze7rbgWTiWa7icUP0o:74dOW4ibEXxXP0 |
| Threatray | 896 similar samples on MalwareBazaar |
| TLSH | 6C536C1BBF0CE143E12547705472559416A6AC6C8E03AF573E8C7F5AE931382BEE722D |
| Reporter |  abuse_ch |
| Tags: | BBVA ESP exe geo GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: server.progresoweb.com
Sending IP: 82.194.74.62
From: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.exe
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=148tFGT3Uagox9JpG9bVfjRyAvJksg02A
Intelligence
File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection:
XpertRAT
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-10 11:51:55 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 886 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.