MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7131ae0e125a318b8298a90aa440839697ccf45a9e48b475419c8186c13df1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7131ae0e125a318b8298a90aa440839697ccf45a9e48b475419c8186c13df1e
SHA3-384 hash: a4c5a2a9322a5057eef6b7948df28dded261ec55df23461daba10f7b08c7487f0b30136d8a96343f34ef3414f2e1cf1b
SHA1 hash: 9c75a424335469bdc6c556592b8271811ed503f7
MD5 hash: 90bb4f2d73c093b05e8a0c76db9e8e3e
humanhash: delaware-glucose-california-cat
File name:Transfer Copy.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-05-26 11:22:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cb288091651c5e262479ba07634be3dc (1 x GuLoader)
ssdeep 1536:yrNnir+8eGcj88D5QKtqbSt6t/occ1FNc:CNnvVX9qxo1FNc
Threatray 100 similar samples on MalwareBazaar
TLSH 69B3C64BB9C96DBBDC388FB2087185641D26FC311C10AB477D49B75D2EB768F19A032A
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

From: mr Grace <grace.yeboah@movis-ghana.com>
Subject: Re: Payment Transfer
Attachment: Transfer Copy.zip (contains "Transfer Copy.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1YLTLxr6bpGIKnMi84pohxjXb9G2GQphN

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/4964/
Detection(s):
Win.Trojan.Fareitvb-7900531-0
Create hunting rule

Win.Malware.Guloader-7900546-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:37:05 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
GuLoader
146de084ff60046edb599a6f8ae1503aa2a7f39c550807e9af069c2e8c9ea34c
GuLoader
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
GuLoader
1e262f53cd67c10635563da64740cbe2467e72f1fe191e1144e1435df9883837
GuLoader
22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f
GuLoader
443bc33e9d28fddd4229367cde23085b8d57549093ce8e991eb4753ce58c85fe
GuLoader
ad8c070c48103dbc11875a052aa0447395f6ddda11e3f9e8aed091f0bb14050d
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
dda25996ab5b78fa63ab71aa304360374fe2eb6ded670c778b2c69d9fa1f1e40
GuLoader
ef8f03a25087eeab581d8439a0a19ba7148270d2210d479c1d6867fac69dc813
GuLoader
+ 90 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-39wqy6dfn6/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip b4c7a1ee5c1b9fd3de6eac512354b5c575617d0252299d5f75d8b5c842d12a57

GuLoader

Executable exe a7131ae0e125a318b8298a90aa440839697ccf45a9e48b475419c8186c13df1e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/368809/
  
Dropped by
MD5 928c91af617163b724691e73ced4585f
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b4c7a1ee5c1b9fd3de6eac512354b5c575617d0252299d5f75d8b5c842d12a57
Cape
Cape
https://www.capesandbox.com/analysis/4964/

Comments