MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cee8a845815daa1914a89033be9f89287fab6194e8b8b700ec058013d6fa8c54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | cee8a845815daa1914a89033be9f89287fab6194e8b8b700ec058013d6fa8c54 |
|---|---|
| SHA3-384 hash: | b4897bbce7d66296b74cf0311fc345b2d5c1cf1bfe4f0e92f1486cb739cb0800f59805279e7ffdd7d6e386649d771305 |
| SHA1 hash: | 4e758225daf767c155ca3c8983499ef129219b2f |
| MD5 hash: | d592a0e9c86f6ff7b54dc27df2061458 |
| humanhash: | one-november-single-missouri |
| File name: | cust_Z0003754_20200501.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 77'824 bytes |
| First seen: | 2020-06-02 11:12:32 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | cb25e340f521bd9566a45a7a7244053e (1 x GuLoader) |
| ssdeep | 768:1hc7416N8lBR2zz9k4b4eh0Z4KGZHaBtf9cDc5Cw5BHkklNuH9cm:1FO8lLa9wg9R6Bt2cEw5BHDNup |
| Threatray | 983 similar samples on MalwareBazaar |
| TLSH | 1F733917AA08CE12DAB142B01D67C3BE2F16BD1C46865E4B345E6F57BB32371AC5E20D |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: safaricom.co.ke
Sending IP: 103.207.38.152
From: <ebill@safaricom.co.ke>
Subject: Safaricom e-Bill for Account Z0003754
Attachment: cust_Z0003754_20200501.zip (contains "cust_Z0003754_20200501.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1Y6aSZh_fiUaoWdGQj_H7w_guI_xshohz
Intelligence
File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Symmi
Status:
Malicious
First seen:
2020-06-02 11:13:20 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 973 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.