MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd95ca4e9ebb20cd4d2e26adfded37285e4321ef95bcee7dd0bbaf309eac8a38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd95ca4e9ebb20cd4d2e26adfded37285e4321ef95bcee7dd0bbaf309eac8a38
SHA3-384 hash: b1dd01366a0f6e769155f27f4801facdf8c05c117d2d53540d6270a1f62fe07f3797bc4f20a5a789cf8a7b0be57b6b59
SHA1 hash: d82b6f31793a0cab27094369c8c0734b6de3cb7c
MD5 hash: 9fe5d007a917b4fb35603183dd698b67
humanhash: alpha-uniform-jersey-lactose
File name:order.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:65'536 bytes
First seen:2020-06-10 06:48:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c079e14d5529f056dc504be77472d3ed (1 x GuLoader)
ssdeep 768:b3w6+GMjJvbviB3/bD8GqHsOmbvDqVubj0ra0GOIDLK+n3Fzu+S31T6FRob:b3kG0gXsHsOoRj5OiLK+n3wIR0
Threatray 838 similar samples on MalwareBazaar
TLSH B9536B5F6D48E963E02087B0297282A56B15BC386901BF4B3E5C7F5DEA316837DD331A
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: Andy Chung (RINNO ALUMINUM CO., LTD) <chy5304@daum.net>
Subject: Request for Quotation - V-40795
Attachment: RFQ_F40796.pdf.img (contains "order.exe")

GuLoader payload URL:
http://149.255.36.133/bin_PqLAqQjAza233.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7457/
Detection(s):
Win.Malware.Malwarex-8014471-0
Create hunting rule

Win.Malware.Malwarex-8014474-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:50:14 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wk4utu6xmqm2tjoe2w733jxfbpegippsw6o47oqxoxtbhvmri4a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0494c6b3493335509d5fdce6d9592d796e592fee648f42dded58ddc29e3565a1
GuLoader
1f6b6d481b672f8ed428a044ebffa9e16424317c0081aad3c00cb61a547b90b5
GuLoader
26fc46f356639b8fe74cd3df54e1416d07d225950c846bf166f3679152a8e5a0
GuLoader
433811102726bc15416ca338a2df55ec1daaf3f2565ee00d7f6484064746fb30
GuLoader
54d3e50350cb0e6e43cae0d762829aeab02a389142d24d5c8d71c413e1d77842
GuLoader
7dc9d4200ada4d75e50d7c4ed86eef952334e4bb69da0464122682e7aff8d971
GuLoader
96ffe97ffd555e8f1329ba24b40cba5320d5bc1ef51fb0155b9dea55bf842487
GuLoader
ad8132d2a341bf731c105eed4dea2357f5ab516c085550294593a2e41f34ebc4
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
d2669f09cb9d457a0bb1ebc7db59cc0f53778ebf2fbd90f84b7c3fd587a109bb
GuLoader
+ 828 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-g5nyj2k762/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 55e420b4e2231cfdf733209a42bca883951d9785a15e7526c5c0598a58a0f3d2

GuLoader

Executable exe dd95ca4e9ebb20cd4d2e26adfded37285e4321ef95bcee7dd0bbaf309eac8a38

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/378987/
  
Dropped by
MD5 d17f163ed8285d08474bdf704ad23548
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 55e420b4e2231cfdf733209a42bca883951d9785a15e7526c5c0598a58a0f3d2
Cape
Cape
https://www.capesandbox.com/analysis/7457/

Comments