MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d
SHA3-384 hash: 9d2efa731303e3e7ab02e90939f0132f772caee1ea3c65c0748debdddb23885852dcc77fc1447bd46ccb578fef18be3b
SHA1 hash: 405014bd6c9d7a699ec43a6cf67d29515cf5eb22
MD5 hash: 5c1b9662ca70e3bd79aa65262ffadcc7
humanhash: xray-music-alanine-single
File name:list.dwg.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:102'400 bytes
First seen:2020-05-22 09:59:06 UTC
Last seen:2020-05-22 10:51:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1002d92e14dc4d0e8a14b48cbd8a260a (1 x GuLoader)
ssdeep 768:h3wEF1JeO4Unkg4EPpojH8cqLJbFH8nU2w6EyZ4Hq53NFF0Urm0G3Fa:NvJeEkg4skXqLJRH2ZEyZ4O3Nzv
Threatray 137 similar samples on MalwareBazaar
TLSH BDA30A31B5D0EC13CA65CDF26DAB4B75140BAC786D198A43A2CB7B2C29775C0A6353CB
Reporter abuse_ch
Tags:exe geo GuLoader KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm38.hanmail.net
Sending IP: 203.133.180.226
From: 오경호 <pop0403@daum.net>
Subject: 중국 수출용 NEW PROJECT -Purchase Order_200522-01 발주서 첨부 건
Attachment: NEW PROJECT - Purchase.img (contains "list.dwg.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1SrbSxlrT9xoe_w1ZAl6Molm77gnXfEXY

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 04:53:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0fe7ea8749ad06ace6adf0d7ffa5f6f22ade0f9acafc4aac72b77f3b7c017ad9
GuLoader
2c1642f94762a15404bbc286403d839f6ceba0659179aa227232af98d2b49d6d
GuLoader
7556ace3bd8a035ca289145f068029f6137fe41f935b32fd1d0b046d1f2e05ab
GuLoader
814e2c04eb5851c9624cf3b0871932e22f99f0b3cbb9b22d987829cb05779e37
GuLoader
a0980c0b0e0c3e32a5910fc48c6a03d5e99338900f7b41d4d7ffd0c70b7354ae
GuLoader
a9266bf550d2639f64352c62d4a4f59ac24cadabb6bb459c448935feb2303816
GuLoader
c3b88b1d9c86a4f7cb1ae7c8b91d44d67c9c9e66ea51504c3204eb575a668fea
GuLoader
c52ca2d3f581c0f1149d3538a985bb896755356d0c00abc546c142accaf0015d
GuLoader
d145458cdc385c244881e7cc9e5a2ec27966eb5de70c601f79449ecddfd90fd0
GuLoader
fe0e6e3be607ade9869e9d5a06c87f2485aaf35a29691f74354d7e6a386e711a
GuLoader
+ 127 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-advn2nsmg2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 050952078d9240cf14a749350e711cddb76e2330336929919832d6a856107ef6

GuLoader

Executable exe f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/365802/
  
Dropped by
MD5 3c1d22c057a3dfff48a80ff4a9148648
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 050952078d9240cf14a749350e711cddb76e2330336929919832d6a856107ef6

Comments