MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbb38a432f7eff2a12b72c3ed853e937fbf5d7b9bd23b9f8ab61beb6bd594c10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbb38a432f7eff2a12b72c3ed853e937fbf5d7b9bd23b9f8ab61beb6bd594c10
SHA3-384 hash: 298ee2131174bb2e98b6309586c63f89c5643116f61662938d02edcc22b60bad13c035193ec8df74ce9c3ea4e1c37332
SHA1 hash: bc3e20a57fd7eb707a47456db3b593fadbb54ea0
MD5 hash: d653553a939998f5181e7f4ea3907a9d
humanhash: finch-twelve-salami-lion
File name:PAYMENT 202005.bat
Download: download sample
Signature GuLoader
Create hunting rule
File size:151'552 bytes
First seen:2020-05-18 19:04:45 UTC
Last seen:2020-05-18 19:39:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7127902759f6df99f2e74d3779921112 (1 x GuLoader)
ssdeep 1536:ETb/hPE6UTyiBdKEevzdvR/Elo0aIwu2paekMFf6aFexWAA7IBLfz/e57ll:+Dhs6+QjvzdJ8DhXYf6aFexhA7ELY
Threatray 774 similar samples on MalwareBazaar
TLSH 08E36BA0F588E912D211593ECFA2DAB9916A7EA14E11CD0B31C57F1F3AF6906D63130B
Reporter cocaman
Tags:bat GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FSTD653553A9399.8536.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 19:35:26 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xozyuqzpp37suevxfq7nqu7jg757lv5zxur3t6flmg7lnpkzjqia._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0ec3c68f6fa845bcc40ea35365aa204f7e8bdf8010ea20dec2e3ea3f46838e02
GuLoader
2ed2a56967e7cb3e18b8b2cb910b9e6d356a52a9b65a05309c36ec62fa09773c
GuLoader
3667b7518f2634bfd589f12fe1fd6e7ec1701030529dd3ece0b04705e76e5e06
GuLoader
37a3468d527e22a4cdd0c1e8717a5bca60db2cd8aaace1a4d25b65eeccd8079c
GuLoader
40c27e805186cc26240cbf37d1d2809412c42e2a3610fdff32cf5b8ce35459e2
GuLoader
a570592bf5a21c1f55712fcec60a0536fedabe28b409d9a48fdc499185e154ff
GuLoader
c688c6b0f5bd44c8d37e810000892ce8d0e2225f1dd04a92d454fd60c7cdc779
GuLoader
ccfc389f6dd3e6d9974b6cd4bb2a2efa5eb060f48e784aabd21a723cb58ff063
GuLoader
da52dddf3fb5de8859dd962bc96eeb267fc4e723682c3defec35672be1441e5e
GuLoader
ddf6f04276c1d976e62e199e6c928fb7a3d7aaec455a1859f8d8f605c89ffc64
GuLoader
+ 764 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-e6mm8614re/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 9474167f6944a612b998bb55e0470ed9bb4b519e2aa06d057e7555b8db6f3898

GuLoader

Executable exe bbb38a432f7eff2a12b72c3ed853e937fbf5d7b9bd23b9f8ab61beb6bd594c10

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 9474167f6944a612b998bb55e0470ed9bb4b519e2aa06d057e7555b8db6f3898

Comments