MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1ab330d8407adbc0731fd66b869bca53515ccf732d1ad498515e5e04f993de4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1ab330d8407adbc0731fd66b869bca53515ccf732d1ad498515e5e04f993de4
SHA3-384 hash: 4ecbf54df6ba8a18d544580b90525923ea8eeac348521a82775b9c120e30cff254171b9d58afc898c86067c045acd775
SHA1 hash: 14083cbfcd8b3028d59250feca13c64ed5763c64
MD5 hash: edf1aac9066ef2cf99b5ce9e09c79d27
humanhash: queen-ink-burger-nevada
File name:SMT Equipments and parts.scr
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-06-03 04:51:56 UTC
Last seen:2020-06-03 05:47:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7e7de59b064494a208f2b499e7ba2e6f (1 x GuLoader)
ssdeep 1536:3SPfxV402FpC5LCl8kgrKHxLdGKc+o0FDHdZ1gIah84N1P/JWuc4UVi:iPXepl+KVdhjFD9zcX1JAVi
Threatray 5'314 similar samples on MalwareBazaar
TLSH CDB38C17FD4C8693D1048BBD2D178EBA3A0DA80D0D411BDF75756E9BAE712422CAB21E
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6228/
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 05:36:34 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgvtgdmea6w3ybzr7vtlq2n4uu2rlthxgli22smfcxs6at4zhxsa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
035c2fa5d912202dd34e8410b14a42b0db007c2be8ed819bbc444f9818497f5b
GuLoader
08b47c6d183afb72f383ced4639ba73a03d9b36f06617585b3a3d28b69d1ce9f
GuLoader
0fd1ddf542f9746a9e25ceb976d416b8385d837d5e71bb02bd9b999083620d9f
GuLoader
30bbf2043054b92e495bbd55f67e43b8eafce430bf31d8aaa4899385e503cdbe
GuLoader
4359188e33f22ea7022cb6e57a3870f2613a1c37dbc483475e02b38cde5bfa8e
GuLoader
52f217cdebe83217297bedc352fac2e475e293e6cad52a1335b3641eeb8c412b
GuLoader
5ea463243b051351c219469515fb9b39d01c5c3c4f4698bd6164e36070622d35
GuLoader
8606768cb758ba8379659f65220250ebc1c491dabd668e7f98663571419cadf2
GuLoader
9daa8e87928b88143b9482b989764524754c86d142027ccaad1fc452f52c1765
GuLoader
c7544c2d4180660fc3a96f3b66b5caa0e168dcfbb35a870f1c576a152ed62348
GuLoader
+ 5'304 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-xpall2swjj/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 0f16075090b711f14454d093d6373311480549a7746f081149bb300fbf8b536b

GuLoader

Executable exe b1ab330d8407adbc0731fd66b869bca53515ccf732d1ad498515e5e04f993de4

(this sample)

  
Dropped by
MD5 7ebc481dd638279b7f92cf59dbeb311a
  
Dropped by
SHA256 0f16075090b711f14454d093d6373311480549a7746f081149bb300fbf8b536b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/6228/

Comments