MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cebea74a88247dc212934829df2370dee3adf5c9acfa6888021067db6c54686d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 3
| SHA256 hash: | cebea74a88247dc212934829df2370dee3adf5c9acfa6888021067db6c54686d |
|---|---|
| SHA3-384 hash: | 253b0a1cd3d7583220d509aa47fbb6a9397d68bc70ed95394a76a220d512cc73590ba7aa7f8b86022715d4257999c8f1 |
| SHA1 hash: | 26b3e7393ad7411efd49098bf1bb2d72ffcbba5a |
| MD5 hash: | b907f17841f58060b10a5ca6f7e3df42 |
| humanhash: | missouri-potato-shade-moon |
| File name: | Purchase Order.scr |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 126'976 bytes |
| First seen: | 2020-05-26 07:53:44 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c7115423f4fcdd131093345bb8195f0f (1 x GuLoader) |
| ssdeep | 1536:vM41fQusQ3kE7if225CzjfnhJ/Le2KJQAaf16s/6Wf5+8l+ubW:kEsQ3z7mz5k/6295ouS |
| Threatray | 241 similar samples on MalwareBazaar |
| TLSH | D3C33A2771D80CA1F9585EB54C2799972E1BEC35B4101B2F364AFB1D32372DA7AB031A |
| Reporter |  abuse_ch |
| Tags: | GuLoader scr |
abuse_ch
Malspam distributing GuLoader:HELO: reseller1.global.ba
Sending IP: 185.99.1.115
From: Sam Stagg <mightyspraying@gmail.com>
Subject: PURCHASE ORDER
Attachment: Purchase Order.zip (contains "Purchase Order.scr")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1Vn27mhyk6AiNL91otZHYI2-WbTb7KrT4
Intelligence
File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2020-05-26 01:29:00 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
20 of 31 (64.52%)
Threat level:
2/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 231 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
6/10
Tags:
persistence
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.