MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e01f7d5f5a34bc9fde408c3f3fb441b76b6a2c3e2915cbf98ac5ca84e61e2b5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e01f7d5f5a34bc9fde408c3f3fb441b76b6a2c3e2915cbf98ac5ca84e61e2b5d
SHA3-384 hash: 955fcdcc1267c8a00d9df0b60b3e25c6b2a95de1699045f7ad45e9461c741912e6a33707cf46c82c5dd4eecd1619805a
SHA1 hash: 988efbad15607cb717e0623935067e642cc8ea40
MD5 hash: 4fced010cc14f22c18cc63263dccf47c
humanhash: mockingbird-friend-butter-mobile
File name:DBSS202001264.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'016 bytes
First seen:2020-05-15 07:29:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9fd981686101f22f0c1a90cd338f1322 (1 x GuLoader)
ssdeep 768:ij5kjK5W3zG9NAnkI991Z/FzwG0qKX8fY4f4WwM9QWu+Pi/nWR15/:IkWbckI991ZqGffY4AWwM9QWu+Yq1
Threatray 1'636 similar samples on MalwareBazaar
TLSH EA83F7257A95EC35C21886F65F6193AD14AFBC311E138A07358B3B7E6A31EC1E47072B
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 04:29:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4apx2x22gs6j7xsarq7t7ncbw5vwulb6fek4x6mkyxfijzq6fnoq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
guloader
Create hunting rule
Similar samples:
0fad781290e1db5165942e6d7254edf797efcb2dc7712963286e054065be4ec1
GuLoader
1f1745eb2812b5c0cc6c26b69661ea1d8ab78a541271950e7b97d0cd2b502db1
GuLoader
20b3c1c5495ed7389cb63dfe6f990c7acd72edd8a6e385cbe698702647d44649
GuLoader
2b419f986ea266fa5826fbb6858782f7c2acfda73aa5ec5cb21d64537d6a4ea1
GuLoader
616b49735927d0f2a78649237770fe83d86db4c50731ac38b8395b85a67ac2e2
GuLoader
890d50ea38e546ea886c5e1d211327e2d4573f3a55f1afc56eacc36ed2187474
GuLoader
bea57552e1978630f3038e4df06ea8fe0d34c9c1656c971f2bb01a894b0f67eb
GuLoader
e09fbb76c70deb9d0d2b2eb99f4d179783e54fc42440c8e478ee834457982f9e
GuLoader
e336780f3321d06dfea57c94467d65e0ab2ab92d77c0267cf17b8d51359a5e38
GuLoader
fe7a6728da6e544a5963774daa1bae063246a1211a815abdb736ea7a31d7bd30
GuLoader
+ 1'626 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-8tb3gzbjxa/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip c2e31126b7a86dd3e03c4001b5777b0d4bb1ceacd1020b5ece4996694fa8f7b0

GuLoader

Executable exe e01f7d5f5a34bc9fde408c3f3fb441b76b6a2c3e2915cbf98ac5ca84e61e2b5d

(this sample)

  
Dropped by
MD5 aa3d7771a0557203270b27993845d2ab
  
Dropped by
SHA256 c2e31126b7a86dd3e03c4001b5777b0d4bb1ceacd1020b5ece4996694fa8f7b0
  
Delivery method
Distributed via e-mail attachment

Comments