MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a62d4c1357cebeab47d417a008454aa34651ee9fd7a606f512784fd1a3a65921. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | a62d4c1357cebeab47d417a008454aa34651ee9fd7a606f512784fd1a3a65921 |
|---|---|
| SHA3-384 hash: | edf4cc5cef7aa88094381539e35b9acbd0c771e8c266d8554e52d329c5052ca8dcba6c2289b2114508ccae901fad7f78 |
| SHA1 hash: | 710481b6b6c018e9e888f3469188353b9fb1b442 |
| MD5 hash: | 4cc1b334f75bcb72bf1d7cb3d7128658 |
| humanhash: | hamper-magnesium-two-michigan |
| File name: | Gorgon CO2 Injection Project.pdf.com |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 94'208 bytes |
| First seen: | 2020-06-02 11:18:41 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 60858209b45cd2563fa09806a5f002c7 (4 x GuLoader) |
| ssdeep | 1536:XiFO8lLAJ+npu9W0BzVX86LzwKQw36/7ytP2VZS:Nm4W0lp8MzwPMYS |
| Threatray | 892 similar samples on MalwareBazaar |
| TLSH | AC930803BAD45511F1B28AB12EBBC2996F25BC1E4942994F340D1E4B7B317629D6C33F |
| Reporter |  abuse_ch |
| Tags: | com GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: seed.net.tw
Sending IP: 139.175.54.24
From: Krizelle Navarro<admin@cyientt.com>
Subject: Cheveron Gorgon CO2 Injection Project
Attachment: Gorgon CO2 Injection Project.gz (contains "Gorgon CO2 Injection Project.pdf.com")
GuLoader payload URL:
https://onedrive.live.com/download?cid=70C4976FC04DDB54&resid=70C4976FC04DDB54%21106&authkey=APvhoK6edHtogfU
Intelligence
File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Fareit
Status:
Malicious
First seen:
2020-06-02 07:22:49 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 882 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.