MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f7bc1d048862d9c11b8ed1a9b294d1d1913d2b11ca19598ec1d7f2e028dd207e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | f7bc1d048862d9c11b8ed1a9b294d1d1913d2b11ca19598ec1d7f2e028dd207e |
|---|---|
| SHA3-384 hash: | f0da01b9a120ea908dd3d2585ea000c4b5b5ab19a3d971e0de863ee017d7a8987228b9001057b4ab0ea2b6b86f3f9f1d |
| SHA1 hash: | 55e583ce1d8dfc96571f278242b93e1fd03c8513 |
| MD5 hash: | 71eb1b8f1e22fc060948beab9226ce38 |
| humanhash: | nuts-snake-montana-pip |
| File name: | invoice.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 114'688 bytes |
| First seen: | 2020-05-27 17:49:35 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 357c91724df9e13a37275631f660c704 (1 x GuLoader) |
| ssdeep | 1536:J6+782eV46YbC9gA1iCzupzTY8qRIqhhkm:J6Z4zbmduh8CqhKm |
| Threatray | 342 similar samples on MalwareBazaar |
| TLSH | 32B32903B2B49C72DD718FB1183195752D3ABD386D144F2B7548BF5E2C36ACA6A9032B |
| Reporter |  abuse_ch |
| Tags: | DEU exe geo GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: dd13516.kasserver.com
Sending IP: 85.13.135.97
From: info@restaurant-alejandro.de
Subject: Auftragsbestätigung und die Rechnung vom 27.05.2020
Attachment: rechnung.zip (contains "invoice.exe")
GuLoader payload URL (dropping AZORult):
http://156.96.118.179/REMM.bin
AZORult C2:
http://digitalpass.duckdns.org/index.php
Intelligence
File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-27 11:39:27 UTC
AV detection:
25 of 30 (83.33%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 332 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.