MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bb19d9c9c18233bf65768ed3534766ae87ada589f6223d015c47d5e4c2523d64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | bb19d9c9c18233bf65768ed3534766ae87ada589f6223d015c47d5e4c2523d64 |
|---|---|
| SHA3-384 hash: | 8e43e039262886ace19eafec32b7b66ef7dfe700126d2842d65601750a0f703ba6f42ed53a24d78d033508d216887c1f |
| SHA1 hash: | e6e9c56842aa9e62834e132ca093d635cdc8c680 |
| MD5 hash: | 75cbff3cf34fc5442bb120c5f8b359ad |
| humanhash: | louisiana-montana-video-twenty |
| File name: | PO_document785553422656757IMG.com |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 106'496 bytes |
| First seen: | 2020-05-28 08:40:51 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2e5329692fb8d009dd53329ae6356d17 (9 x GuLoader) |
| ssdeep | 1536:wNnpoEYVNANQuTw05KurM907rUTaIeSFphVq4FbAvHxNjE:Sn4/ut5NM907rUTaIlFcM |
| Threatray | 2'469 similar samples on MalwareBazaar |
| TLSH | 8BA306236A90EB61C53085F029078B6D157BFE3401D2495BB1DD2B4B3BB19E6FA2C34B |
| Reporter |  abuse_ch |
| Tags: | com GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: trorgaz.com.tr
Sending IP: 45.147.228.105
From: Atunga Harmantepe<atunga.h@trorgaz.com.tr>
Subject: RE: Urgent Request Quotation For HTR 864
Attachment: PO_document785553422656757IMG.IMG (contains "PO_document785553422656757IMG.com")
GuLoader payload URL:
https://onedrive.live.com/download?cid=63287B596430CB27&resid=63287B596430CB27%21107&authkey=AHre-6Bw68haI00
Intelligence
File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Gathering data
Threat name:
Win32.Trojan.Kryptik
Status:
Malicious
First seen:
2020-05-28 09:36:18 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
5/5
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 2'459 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.