MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e180e8ae6521bb30a7baaeaf95c7583815922ef07c695c5a6fc7c123b6442d7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e180e8ae6521bb30a7baaeaf95c7583815922ef07c695c5a6fc7c123b6442d7b
SHA3-384 hash: 6354898e8476fcfb188fcc216d7935fad621d224d73e42bc7d5955ff66d96eca08d2e45dc6af2c61363629332a0da013
SHA1 hash: 739d3d15013c21c464b72ac8dea90ad61f6c63fe
MD5 hash: 6c9affa92ea3262897f0df540b61e711
humanhash: uranus-cup-florida-video
File name:Rechnung.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:106'496 bytes
First seen:2020-05-21 19:28:57 UTC
Last seen:2020-05-21 20:45:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 87cdc30a7be3a0c49be0454d8c92f61e (2 x GuLoader)
ssdeep 1536:JB7eHtsfa9/aA7vjxN8WLVJ0ZDvN1DOH1:TeHtsSn51UNC1
Threatray 118 similar samples on MalwareBazaar
TLSH F5A32931BCE0ED81CB1488F65E6B5B7A115F7C70254A4E03A6CBBE2C39765D2EC69306
Reporter abuse_ch
Tags:DEU exe geo GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mxout02do.versatel.de
Sending IP: 89.245.129.165
From: kidrth@versanet.de <kidrth@versanet.de>
Reply-To: kidrth@versanet.de <kidrth@versanet.de>
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 21-05-20 Rechnung_20-613129926-001
Attachment: Rechnung1.zip (contains "Rechnung.exe")

GuLoader payload URL:
http://156.96.118.179/RSol.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 19:35:49 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1a3223bf578249a17b6d1f8ee0ed8a5fd49690621f3ea63d0380db03f2c31e50
GuLoader
2a3b5f4a6e6d41c86a9d25ff46831b1bcf73db123bf659d59c8125c147afc895
GuLoader
35628fc8f90a6db8f30ab2f3ec4b743190381958f72c75d1a8ae828d6afb6370
GuLoader
37299afa1d46a1aa02b7b06a39d41d876f454047527e406e7cbcb659833de728
GuLoader
3e7c9776603755bddcdb1093fe8980f16a0b0228d45b9bc83a4d8fef1e1d59d1
GuLoader
9e4e7f1d55db4c01612f4fb87b648fb0a1edcaf1e57f7ae41919d029196d41f9
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
e76ee0db44278c0742805ce66786923629cad847ee8c650214a36a1ebda37c69
GuLoader
ee89a8d22b1d40f75fc6d37660f3e1c3c972fdd2e21585af4de053c2a2223f21
GuLoader
fb929a20bfd4d36c126f3d26b95aadf256f2f85ef3b2564f9a79fd7cc92f7eb5
GuLoader
+ 108 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-67wbjhskte/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 2556b14cc704b771a75923d97fda58530248fdf2c0a89ff28a2df61f60f52662

GuLoader

Executable exe e180e8ae6521bb30a7baaeaf95c7583815922ef07c695c5a6fc7c123b6442d7b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366085/
  
Dropped by
MD5 b0442c97ecce0262d09c2703f3141b20
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 2556b14cc704b771a75923d97fda58530248fdf2c0a89ff28a2df61f60f52662

Comments