MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 aec92581e48c5a9f8e8b920d595ecab2a0af7c81bc49e5d2d3d4bb9c317f1999. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | aec92581e48c5a9f8e8b920d595ecab2a0af7c81bc49e5d2d3d4bb9c317f1999 |
|---|---|
| SHA3-384 hash: | 87374f4e28b4d08d304a2e2dc2926db947748dcaf885abea4493a12dd29927808528f07dd0b47c1228e600a7b6011ea2 |
| SHA1 hash: | 1cff33fed21bd60d3d2523554464b2b318dc2e2f |
| MD5 hash: | bc16f41d2fac516285a1582257c2a44c |
| humanhash: | jupiter-uncle-december-video |
| File name: | BUSINESS-FRANCE PROJECTIMG.com |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 69'632 bytes |
| First seen: | 2020-06-10 11:40:04 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7f174a726307bad94f3cbcf69e72ed03 (8 x GuLoader) |
| ssdeep | 1536:rV7OrmYYY1w+7xrUYCBb+UsRiTOUqMGlB5DO4ypmwFDc2hnkKz:SmYYYSCxrUY2+UsITOwmB56tFD1hnka |
| Threatray | 1'010 similar samples on MalwareBazaar |
| TLSH | 8B635C1676A1ED71EBB546F76FB09294449BE93204D2880378543F1F163A84FF97630B |
| Reporter |  abuse_ch |
| Tags: | com GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: businessfrance.fr
Sending IP: 45.153.241.193
From: alberto.m.frescura <alberto.m.frescura@businessfrance.fr>
Subject: RE: RFQ BUSINESS-FRANCE PROJECT
Attachment: BUSINESS-FRANCE PROJECT.IMG (contains "BUSINESS-FRANCE PROJECTIMG.com")
GuLoader payload URL:
https://onedrive.live.com/download?cid=BB419EE18BF3F1DA&resid=BB419EE18BF3F1DA%21106&authkey=AEJmsUJrmBEjg8Y
Intelligence
File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-10 11:41:09 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 1'000 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.