MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa8949da882bd317bc4b975dac2514553258a79a3ec0e7bb2e029f61e131ed66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	fa8949da882bd317bc4b975dac2514553258a79a3ec0e7bb2e029f61e131ed66
SHA3-384 hash:	673edf61e1709b7eb0de62ae55d45ae59a1276e5e2d24ceb77d542d4b1ab7b2df51b364b17628810b3751a5ca9f0e4f5
SHA1 hash:	3c5bcdb7672a9fc707a6286a2128c716894deb51
MD5 hash:	5c61b7a3bf87711d4bda5e69861d3ccd
humanhash:	may-william-william-michigan
File name:	UNDERS.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	86'016 bytes
First seen:	2020-06-08 18:59:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8ee0f9312ca548bda7b79a41cab626e6 (1 x GuLoader)
ssdeep	1536:Zyf8uRtSWkD+SCRCOCRCcrZriaR0RYLSjgTUq9xttXHxQEE:ZyhoDO8F8cuhgtLP
Threatray	824 similar samples on MalwareBazaar
TLSH	5A838E1BBA2CC142D54406B12CF28F661B27BD1548826F4B72C6FE4FE8B57427DB622D
Reporter	abuse_ch
Tags:	exe GuLoader

abuse_ch

Malspam distributing GuLoader:

HELO: genopem.tk
Sending IP: 135.181.24.152
From: international payment <iban@crdbank.com> <admin@genopem.tk>
Subject: Project: BAB Integrated Facilities Project (BIFP) Closing Date: 30th May 2020
Attachment: RFQ Document_pdf.gz (contains "UNDERS.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=F5533CD060D35070&resid=F5533CD060D35070%21177&authkey=AIicpy7xxFYR5kQ

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/7165/

Detection(s):

SecuriteInfo.com.Win32.Injector.EMHI.11921.UNOFFICIAL

Gathering data

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-06-08 19:01:08 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7keutwuifpjrppcls5o2yjiukuzfrj42h3aopozoakpwdyjr5vta._file

Verdict:

malicious

Label(s):

guloader

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-e1hqqz29zx/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of NtSetInformationThreadHideFromDebugger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_vobfus_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator