MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c99caaeafc28f97895ebdd8533d7c7ac5b617fb0f188827c193a948c237aebb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | c99caaeafc28f97895ebdd8533d7c7ac5b617fb0f188827c193a948c237aebb4 |
|---|---|
| SHA3-384 hash: | d72848631416bc2f831d7c6c48b5338700974f79d31ebb69511ab369d79c661f15a3578bbfe5d1b20a80136c31a5e49c |
| SHA1 hash: | 191e8cecd49ba4725ef32da63943b1367fa80e06 |
| MD5 hash: | 3da7bbf4b9a736ec22ec15075adde589 |
| humanhash: | equal-oven-king-eleven |
| File name: | Swift Copy #05272020.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 114'688 bytes |
| First seen: | 2020-05-27 17:38:42 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7920f6376c4cdcb65198817b7f650aba (2 x GuLoader) |
| ssdeep | 3072:SnHFuveBKLtojFTHQjRQP6M0PBgP1fq4VKefi+kVab3on:M06HdtKxVab3o |
| Threatray | 90 similar samples on MalwareBazaar |
| TLSH | 51B33A16FDD04CB1FD398FF58976DA681C36AC756C248F0B3686B75C253728A7AE0214 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: digamma.host-in-europe.com
Sending IP: 62.75.189.83
From: kudinova@otis.kz
Subject: Payment Sent T/T Receipt Attached - Overdue Invoices Payment
Attachment: Swift Copy 05272020 1.zip (contains "Swift Copy #05272020.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1Xz0ePHLZIeLjaaJwRhSU_Zg1x33bcqXM
Intelligence
File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Fareit
Status:
Malicious
First seen:
2020-05-27 17:59:38 UTC
AV detection:
23 of 30 (76.67%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 80 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.