MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bf2c56fa8b5e9c316ec1dd825a2f0275bc3a8356723d7cd0ff2a3ca5166e6e52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | bf2c56fa8b5e9c316ec1dd825a2f0275bc3a8356723d7cd0ff2a3ca5166e6e52 |
|---|---|
| SHA3-384 hash: | 392884e60b0b6fb848fc3900bd3f3fc3c1cc5a551e16774dbc081bfce6decd64e3b57f28243715723af36c8ce43a3fb8 |
| SHA1 hash: | 2ed1e330993fc187816271dedd9860f46b807565 |
| MD5 hash: | b613be4230e85742dad201e906f79200 |
| humanhash: | five-west-pizza-arizona |
| File name: | RFQ.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 55'032 bytes |
| First seen: | 2020-05-26 07:21:07 UTC |
| Last seen: | 2020-05-26 08:15:21 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b54b7b72b99529f6b9e7aee2da124faa (1 x GuLoader) |
| ssdeep | 768:jo+ZBuCPpCidtUVwrySB3FBOiSXj0JhIlX3jqA+nh+ez/IKASOwbDWH:sMRBCkUwZ3n7SzweqLI1wbDWH |
| Threatray | 5'117 similar samples on MalwareBazaar |
| TLSH | 3533F8E1F1F0207BD2B3DE70DE3685E800BB7D7C360A94572A5478CB0A7D909E65962B |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
Code Signing Certificate
| Organisation: | Metrummets |
|---|---|
| Issuer: | Metrummets |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | May 25 13:25:52 2020 GMT |
| Valid to: | May 25 13:25:52 2021 GMT |
| Serial number: | 00 |
| Intelligence: | 325 malware samples on MalwareBazaar are signed with this code signing certificate |
| Cert Graveyard Blocklist: | This certificate is on the Cert Graveyard blocklist |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | 1AC09D852F06428F30752F9FDD4EA12B7FED74E15B6355331BD36097AF7A2486 |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
abuse_ch
Malspam distributing GuLoader:HELO: vm9win2.securesurfs.co
Sending IP: 162.213.42.222
From: Exports Suppliers <support@goldfx.co>
Reply-To: support@goldfx.co
Subject: Re: Invoice
Attachment: INVOICE.IMG (contains "RFQ.exe")
GuLoader payload URL:
http://37.72.175.206/bin_tsIZxkjw175.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-26 02:43:39 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
18 of 48 (37.50%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'107 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.