MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9767731cae5b82c792fc165a9f024425866ca4fbde32b2dd4e9ac6fe12bc3548. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | 9767731cae5b82c792fc165a9f024425866ca4fbde32b2dd4e9ac6fe12bc3548 |
|---|---|
| SHA3-384 hash: | 26e77669d408d85ce83d62e73a2eb27c1381c2456a3dda464a04ad151978651e49ed4754693d451b093e8f9052d4fd75 |
| SHA1 hash: | 607274b676667ba2f7fad4cca53171d6fa0f3ab0 |
| MD5 hash: | 6165ac76ca223f573e4763a03442a285 |
| humanhash: | dakota-thirteen-early-enemy |
| File name: | INQUIRY.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 122'880 bytes |
| First seen: | 2020-05-26 07:51:45 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 63d7e804c2548de089b3824c17d0de86 (1 x GuLoader) |
| ssdeep | 1536:HWIHf/+J9vClTQsDe1DT/hOhsKiB05RSsH0kAr8AUUb6:2I//+HvC+s2T/UslvoUm |
| Threatray | 1'777 similar samples on MalwareBazaar |
| TLSH | 29C32A13B5D85CA5E8180EB10C13AA932B23ED3579556F133E45FA6C3A325CA3EF171A |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:From: Howe Robinson Partners/ SNP <snp@howerobinson.com>
Subject: CARGO INQUIRY
Attachment: INQUIRY.rar (contains "INQUIRY.exe")
GuLoader payload URL:
https://thedebagroup.com/man.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-26 08:37:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
18 of 31 (58.06%)
Threat level:
5/5
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 1'767 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.