MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d87c6077423627f449ad0706b6aae722a75b8cb2bd8f977b01b2ee5d6333b069. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d87c6077423627f449ad0706b6aae722a75b8cb2bd8f977b01b2ee5d6333b069
SHA3-384 hash: 6aa01c8000bc0587bbcfa00d1e806ed87c2511b8385e3f3532cb7df7ba845d0d25f2acde3a31ad9d9829a7807de1a4d2
SHA1 hash: eee65fcd79fde5d049b46ba91df1a2c1db6a01c2
MD5 hash: 1d56006b9a0ea66f000df8cc6bcb1bc6
humanhash: berlin-eighteen-burger-michigan
File name:form.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:81'920 bytes
First seen:2020-03-23 05:53:29 UTC
Last seen:2020-03-23 07:45:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9a8aa3655c7b5623b045e4acd75e46ec (1 x GuLoader)
ssdeep 1536:Pqis1YAetxPgu4102IvQEXtBfHhmqUMWbR:fAePo1zIvQsth3UP
Threatray 596 similar samples on MalwareBazaar
TLSH 21836B03F740EC65C45CCA3E6C4BD6D02113BEE96991D667B6D0BF0F78F21628E1AA58
Reporter paleoarchean
Tags:COVID-19 GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-7639438-0
Create hunting rule

Win.Malware.Generic-7639551-0
Create hunting rule

Win.Trojan.VBGeneric-7639617-0
Create hunting rule

Win.Trojan.Vebzenpak-7639767-0
Create hunting rule

Win.Trojan.Vebzenpak-7699953-0
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/331326
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-03-22 23:22:54 UTC
AV detection:
27 of 30 (90.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3b6ga52cgyt7isnna4dlnkxhektvxdfsxwhzo6ybwlxf2yztwbuq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
093067924e8912798634d4db6faa33ada93f223939027af8c8a65af4263bed24
GuLoader
263de484cf55f9d3d6d7cad6bf3e4a0b34c1e553daf1edec77a239a3d5f04e2e
GuLoader
313f99f5a4fd2ee3bd7b4f1c080a581267d9c5aff9ca4edbb1403d05b00c5c02
GuLoader
720cf0a7e3b7d3c3797b222ae40f89dadedf951fd7e7f311ca703dd1be55bb71
GuLoader
80c4000e65ff310fe0cefdfcb11f0b70fe1ffabc34aba3e05a51d5d03fa4930f
GuLoader
80dfc2a3d57919f0f79628c2747b9d3d17cb397756b96797643f222f10d0d34d
GuLoader
85b393f8bfd5d3e61522dac9e3c57c3d2f75b846146e9507e709c00813e349b8
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
cc5e11dc13759723df847785ddf888d5e5d3733687e4812e420df783217049de
GuLoader
e54b26c70fca067b3e4b78bfc4bce96cd9e5d5173e7fecae50f8e1a10ddb85e4
GuLoader
+ 586 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar b8980e7c60ae987813f6202f7f38843291070a88751a1d1bbcc7e09ca880d23a

GuLoader

Executable exe d87c6077423627f449ad0706b6aae722a75b8cb2bd8f977b01b2ee5d6333b069

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
URLhaus
https://urlhaus.abuse.ch/url/326937/
  
Dropped by
SHA256 b8980e7c60ae987813f6202f7f38843291070a88751a1d1bbcc7e09ca880d23a
  
Dropped by
MD5 7d3702f637a36561e72986ac415b01ad

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments