MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d106f149f1605d6e64cf05b6d1208343cbf2f5a3491de4c6b05e12f77fa6ae31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: d106f149f1605d6e64cf05b6d1208343cbf2f5a3491de4c6b05e12f77fa6ae31
SHA1 hash: 70eceaf6ee33dca04993c9d86c3ffb4b88775841
MD5 hash: f4e0049944ac03049e8a88113169fa2d
File name:0022-5-2020.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 10:02:30 UTC
Last seen:2020-05-22 10:52:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7681e5f23cb1f62f50c723d91b30549f
ssdeep 768:kz3uH9zZfXx067RBSWlcrE/gMkScxRocXCN1taJxq7nkhpT8rTy8aS:s3md06eu/gMkSbDkbU1
TLSH EC933A61B4D4EEB2E6258FF609F58284156BFC3A1A044A1334CD3F2E253798EDA35357
Reporter @abuse_ch
Tags:exe GuLoader

Malspam distributing GuLoader:

Sending IP:
From: Account <>
Subject: Bank in slip
Attachment: (contains "0022-5-2020.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
IT Italy Low
Global Low
# of uploads 2
# of downloads 26
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
VirusTotal:Virustotal results 15.28%
ReversingLabs :No data

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe d106f149f1605d6e64cf05b6d1208343cbf2f5a3491de4c6b05e12f77fa6ae31

(this sample)

Delivery method
Distributed via e-mail attachment