MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b584d8b69ef7c3f2689e4cecbec9932b84ca55e03c87b1aa9a9b9f56a1ba6c94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | b584d8b69ef7c3f2689e4cecbec9932b84ca55e03c87b1aa9a9b9f56a1ba6c94 |
|---|---|
| SHA3-384 hash: | 30213563e6d38e4af979e12df72ef1269547992bc9304bc9f447c851966e7c32ef0c7e1bf74554415befd9bff817487f |
| SHA1 hash: | b5085863638165cb0d185e19dee16dd942dae34b |
| MD5 hash: | 279455eab42afc6f98fd9c47184fa2d9 |
| humanhash: | april-network-hawaii-comet |
| File name: | gunzipped |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 102'400 bytes |
| First seen: | 2020-05-20 08:43:35 UTC |
| Last seen: | 2020-05-20 09:48:43 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 387628e6b3d4d025fafd76a4f0d71a7f (1 x GuLoader) |
| ssdeep | 1536:YxHm8qSmbGdSdSOl/V0IcTZBnjltzMt2w5:0HRZRooU/V0P1k2G |
| Threatray | 1'514 similar samples on MalwareBazaar |
| TLSH | 22A31821FAA8ECA1CA6449FE4E615AEC064FBC741A11C71F30C5372E09F3A85D97631B |
| Reporter |  abuse_ch |
| Tags: | GuLoader |
abuse_ch
Malspam distributing unidentified malware:HELO: mail0.82.igfxinvest.com
Sending IP: 68.183.88.97
From: Kelsey Morrison <kmorrison@82.igfxinvest.com>
Subject: PO # 4507600698 - Rev 01
Attachment: PDF.PO 4507600698 - Rev 01-PDF.gz (contains "gunzipped")
Intelligence
File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-19 23:22:04 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 1'504 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.