MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c60f1b4267812d2650795dbc1df35f5bd590bcd24253a7fcb580e7c961b9523b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c60f1b4267812d2650795dbc1df35f5bd590bcd24253a7fcb580e7c961b9523b
SHA3-384 hash: f577522d079e68957054b3362489b44bc6e36c1695ef28a346ec93921db904e7e56260ba914f4f8e50f4609b388e67f1
SHA1 hash: 9256406ff395c487dbb11e714a1b388a88d730c5
MD5 hash: 6eee4c1725f3a9394b8093d627469cfa
humanhash: louisiana-carpet-idaho-oxygen
File name:VIETNAM PRECISION QUOTATION.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'208 bytes
First seen:2020-05-09 21:18:35 UTC
Last seen:2020-05-09 21:37:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a630a46b3ba47a16f00e1486d5834e99 (1 x GuLoader)
ssdeep 768:Glm2umymNWHqm59RRxRfEJ1L4T2UD9eXLrrr7k1gLo/uszr2se:GlumnSxT2EwPrr7Xo/uyze
Threatray 923 similar samples on MalwareBazaar
TLSH C49393C1B3E4E427E9DC0DF25FA4D398A0A1BC756806EA0B77C0779B1935991E250B73
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-09 06:18:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yyhrwqthqewsmudzlw6b3427lpkzbpgsijj2p7fvqdt4synzki5q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
14885a4bfd76cdb49db108d03ce3a8c88c301c786eed577606aaacc49d673bfa
GuLoader
34d5bd380c2902b64435c9e3cb3a917b329cdbde53397cac6ec767af3904b2f6
GuLoader
409b5df63705aabc1454bfe5a37b511cb6b38e10876fa39fe2609bc05d8ac169
GuLoader
4e49f8ed15a69e1147ae9428c9e5b4d4aa928769f261627abc059d2060e94a6b
GuLoader
4e7757f18ae0c6aeac44ed49de53657e81d46474c75c431b291e3e5712b94045
GuLoader
54a1f9c8f39feac2378a5e2221e95dc41167cd80d541f448e0ec3e347f183029
GuLoader
6617979630def30c8a103baceedd1ddb972a53b984de91682aa93451faf833bb
GuLoader
726156ccca0ba0077df20db0e438db482c7197d69453b890332ed69a9e509352
GuLoader
96e695effa7be570f49f665ad01907c413443b0f51fdbec6372d2ff7c9861d72
GuLoader
d9073504ba97540b65006d851251f330bcfb130500daad9a7f8616cb5a6a9ba0
GuLoader
+ 913 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-jgta2zsssa/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 9db975bf6ac25f05832819bee85ee54d15a52340296d13d595a0c4ac06668071

GuLoader

Executable exe c60f1b4267812d2650795dbc1df35f5bd590bcd24253a7fcb580e7c961b9523b

(this sample)

  
Dropped by
MD5 3cf619f05993de79ad3e6150ba65530d
  
Dropped by
SHA256 9db975bf6ac25f05832819bee85ee54d15a52340296d13d595a0c4ac06668071
  
Delivery method
Distributed via e-mail attachment

Comments