MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cf6542bb87d706ab7d6fd3f7fa0a2594d3b0ed8a9d15b481252d0c405ecd36ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | cf6542bb87d706ab7d6fd3f7fa0a2594d3b0ed8a9d15b481252d0c405ecd36ef |
|---|---|
| SHA3-384 hash: | e0954f4826add6c36cd28223a59066b5d8f15f98bf818741293a1831c34eac1f06cf00d7aa0d1ceafdd58f35581af4da |
| SHA1 hash: | c62780d19cf03f21d62a91782a96fa37a35aa38e |
| MD5 hash: | 64e1914c722977019216c1b843b436a5 |
| humanhash: | pennsylvania-lemon-river-autumn |
| File name: | DHL AWB.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 81'920 bytes |
| First seen: | 2020-06-08 12:13:50 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d0362c5ede091a4e4f81baf26fcb9b13 (1 x GuLoader) |
| ssdeep | 1536:7uRtSabmagB97ZriacwkpsxAqC+0csVkmi4w:S7bvgBSsxDN |
| Threatray | 1'215 similar samples on MalwareBazaar |
| TLSH | C8839E137554C106E1A585702CA39EB52B66FC2818415F4B6089FF2FF8B9B536C7B32E |
| Reporter |  abuse_ch |
| Tags: | DHL exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: slot0.cn-nakareg.com
Sending IP: 45.95.169.32
From: "DHL EXPRESS" <info@cn-nakareg.com>
Subject: DHL BILL OF LADING SHIPPING DELIVERY NOTICE
Attachment: DHL AWB.gz (contains "DHL AWB.exe")
GuLoader payload URL:
http://baritaco.com/build_VSJicTAg206.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Gathering data
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-06-08 12:15:07 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 1'205 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.