MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bee2e75a7187b8d59c62e37425a14998512cdc6d5cf0023151ad071f0750f4c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | bee2e75a7187b8d59c62e37425a14998512cdc6d5cf0023151ad071f0750f4c7 |
|---|---|
| SHA3-384 hash: | 5128466242372f59f48d94dfea882c80d9197201217a7fe191407aacc1638ec47de59154e6999d0c9b4e53d641958e4d |
| SHA1 hash: | b7005118fadc1be4b563815c3f674f731d90fd1c |
| MD5 hash: | c57167e8b33c683c78e4b4f3fc8cfe97 |
| humanhash: | lion-eighteen-georgia-magnesium |
| File name: | valgnederlagenes.com.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 102'400 bytes |
| First seen: | 2020-06-09 11:53:57 UTC |
| Last seen: | 2020-06-09 12:48:36 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 70e5e0c510dfdfe56354b0535933a9bf (8 x GuLoader) |
| ssdeep | 1536:ze4u4c/lEiwWnSKBCTYdVen5J+GJNwK7OosYY8cnLhcQp9dOus89:ze/lBSKAToVeH++3alhcQZOus89 |
| Threatray | 1'998 similar samples on MalwareBazaar |
| TLSH | 31A39EBABAD16FA1F5440AB539B4866820BBBC3112C1C61F63C06F3E2672D95F472353 |
| Reporter |  abuse_ch |
| Tags: | exe geo GuLoader TUR |
abuse_ch
Malspam distributing GuLoader:HELO: ber-sa.com
Sending IP: 45.153.241.147
From: surat<admin@ber-sa.com>
Subject: ISTANBUL PROJECT-OFFER REQUEST
Attachment: PO-order782637728278727783.img.iso (contains "valgnederlagenes.com.exe")
GuLoader payload URL:
https://onedrive.live.com/download?cid=2A23967391108A38&resid=2A23967391108A38%21106&authkey=APY1s0yVrWA_NOk
Intelligence
File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Gathering data
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-06-09 11:55:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 1'988 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.