MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b870ae1ce131cc6c8a312938af066d34e7f910c1aaf1d68473b0b076d01164a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments

SHA256 hash: b870ae1ce131cc6c8a312938af066d34e7f910c1aaf1d68473b0b076d01164a9
SHA3-384 hash: 57f12e90d93a78f6d4141ed47ee1fbb020006e10e260ed166ef7dc548512a0857e1ba80691e5b7eb427d2e379a6b335d
SHA1 hash: bf3fc6baa7179eff29d492b3976469b945a92a48
MD5 hash: 2c60f8ecd8bc6238d519b9a1b3d7700e
humanhash: artist-harry-single-arkansas
File name:BLT-882020.exe
Download: download sample
Signature GuLoader
File size:114'688 bytes
First seen:2020-05-26 11:23:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c8aac5ec9491ae85fed60464326da739 (1 x GuLoader)
ssdeep 1536:lWO8SCnuNRuhyjjY0iollg6e8k7voGWE:MOzgL23gv8EQGx
Threatray 199 similar samples on MalwareBazaar
TLSH 8EB3080379D86C72EC2CABF29C7185640DB5BC117D014B47BE4AFB5E29722CE94B078A
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: gmail.com
Sending IP: 103.89.88.225
From: Accounts <accounts@gmail.com>
Reply-To: goodluckfresh@gmail.com
Subject: Re: FW: BLT-088 DOC
Attachment: BLT-882020.Y45.zip (contains "BLT-882020.exe")

GuLoader payload URL:
http://rayyanceram.ir/chucksman_KKlPG78.bin

Intelligence


File Origin
# of uploads :
1
# of downloads :
67
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Guloader
Status:
Malicious
First seen:
2020-05-26 11:37:11 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe b870ae1ce131cc6c8a312938af066d34e7f910c1aaf1d68473b0b076d01164a9

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments